Enterprise ransomware protection: How to stay recoverable when an attack succeeds

On October 19th, 2025, ransomware stopped all shipping from the logistics centers of Askul, a Japanese office supply and e-commerce company. The attackers had entered through an administrator account issued to an outsourced contractor—the one account the company had exempted from multi-factor authentication (MFA). When attackers encrypted Askul's servers, they also deleted its backup files, and part of the stolen data was later published online. ^[1]

Askul's own investigation found that its online backups had not been designed to withstand a ransomware attack, so attackers were able to encrypt some of them along with everything else, which significantly delayed recovery. ^[1] Askul is far from alone. Ransomware targets backups in 4 out of 5 attacks, aiming to force ransom payments by destroying your ability to recover. ^[2]

This guide covers how an enterprise attack unfolds, the layers that stop it, why backup storage with Absolute Immutability is your ultimate ransomware defense, and how to evaluate the solutions that claim to provide it.

Key takeaways

• At enterprise scale, ransomware protection depends on whether one stolen set of credentials can reach everything, including backups, because in most cases, attackers use administrator rights to destroy recovery options before or as they encrypt.

• Ransomware is now a near-certain threat: more than 4 out of 5 organizations have suffered at least one attack in the past two years. ^[2] No single product is enough; protection requires a layered set of controls covering identity and access, email and endpoints, network, detection, and backup and recovery.

• Standard immutability often has hidden exceptions and loopholes that could allow backups to be deleted, but with Absolute Immutability, nobody can alter or delete backup data, even with admin credentials. While 93% of technology leaders say absolutely immutable backup storage is critical for ransomware protection, only 16% have it. ^[2]

What is ransomware protection?

Ransomware protection is the combination of technical controls, policies, and recovery capabilities that protects an organization from ransomware attacks and limits the damage when these attacks succeed. It has two jobs: stopping attackers from getting in and spreading through the network, and ensuring the organization can recover when an attack succeeds anyway.

Both jobs become harder at enterprise scale. A single virtualization console can run hundreds of virtual machines; privileged and service accounts multiply across departments and partners; and the backup system has its own administrator console, which an attacker with stolen credentials can sign in to just like a legitimate administrator.

Recovery, in turn, means hundreds of restores carried out in business-priority order. With so much reachable from so few accounts, enterprise protection comes down to whether a single stolen set of credentials can reach everything, including backups. Closing that path, so that no single account can destroy both production data and its recovery copies, is the foundation of ransomware resilience.

How does a ransomware attack unfold inside an enterprise?

A single set of credentials that reaches everything is exactly what attackers look for. More than 4 out of 5 organizations have suffered at least one ransomware attack in the past two years. ^[2]

The sequence below follows the phases of a ransomware attack at its very worst, in which ransomware protection fails at every step and the attackers reach their goal.

1. Getting in. Most attacks start with an email or a stolen login: malicious email, phishing, and compromised credentials are the three leading root causes of ransomware attacks, at 26%, 24%, and 23% respectively. ^[3] Askul's attackers simply signed in using a contractor's administrator account with no MFA. ^[1]
2. Staying out of sight. Once inside, attackers often spend weeks mapping the network, disabling security tools, and clearing logs as they go. Askul's intruders did the same, disabling endpoint detection and response (EDR) software and using several ransomware variants, some of which slipped past Askul's EDR signatures at the time. ^[1]
3. Collecting the keys. Every system attackers reach yields more credentials, but the main targets are the accounts that control the infrastructure: domain, virtualization, and backup system administrators.
4. Spreading across the estate. With administrator rights, attackers move laterally from server to server until they control the systems that manage everything else, from the hypervisors running hundreds of virtual machines to the consoles that manage backups.
5. Taking the data. Before anything is encrypted, sensitive data is often copied out of the network. That copy is the basis of double extortion: the victim is pressured to pay once for a decryption key and again to prevent the data from being published. A clean restore solves only the first problem. Askul refused to negotiate, and part of its stolen data appeared online. ^[1]
6. Removing the way back. In most cases, attackers move to eliminate recovery options before or as the encryption payload drops, using the rights collected in step 3. A backup system that accepts a valid login cannot tell an intruder from its own administrator. Askul's backup files were deleted at the same moment its servers were encrypted. ^[1]
7. Encrypting everything at once. Encryption then runs across many servers simultaneously, often at the virtualization layer, so hundreds of systems go down together rather than one by one. The encrypted systems at Askul included those running its highly automated logistics centers, and shipping stopped entirely. ^[1]
8. The demand. The ransom note arrives with two conditions: pay for the decryption key, and pay to keep the stolen data private. With the backups gone, the key is the only remaining path to the data.

The five layers of enterprise ransomware protection

No single control in a ransomware defense strategy can break the sequence above, because each control stops only some of the attack steps.

Since no system is impenetrable, ransomware protection in enterprise environments follows a simple model: assume a breach, build multiple layers of cybersecurity, and prepare for recovery. ^[4]

The National Institute of Standards and Technology (NIST) takes the same approach in its ransomware risk management profile, which places recovery alongside protection and detection within a single framework. ^[5]

Identity and access

Identity controls target steps 1 and 3 because most attacks require a valid login before anything else. MFA on every remote and administrative account makes a stolen password far less useful on its own. Least-privilege access restricts each account to only the systems and data its specific role requires, so a stolen account opens only a small part of the environment.

Privileged access management (PAM) adds tighter control over the accounts that attackers target most. A PAM tool grants administrator rights only when they are needed and records how they are used.

All three work only if no accounts are left as exceptions, including those issued to partners and contractors.

Email and endpoints

Email filtering helps prevent much of the phishing behind step 1 by checking senders, links, and attachments before messages reach inboxes.

EDR tools then monitor servers and laptops for malicious behavior during step 2, such as unusual processes or attempts to disable security software. Attackers expect EDR to be in place, so switching it off is often one of their first moves after gaining access to the network.

AI-powered ransomware adds a further challenge. It can generate or rewrite its own code so that each version looks different, which leaves signature-based tools with no stable pattern to match.

Email filtering and EDR work best when their alerts feed the detection layer rather than standing alone.

Network

Network segmentation slows step 4 by dividing the organization's network into separate zones that an attacker has to cross one at a time.

Critical systems, such as hypervisor management and identity servers, should sit in zones that standard workstations cannot reach directly, so a compromised laptop is never one hop away from the infrastructure.

Monitoring traffic crossing between zones helps reveal an attacker moving through the network. Most systems follow predictable patterns, so an unusual connection, such as a remote desktop session between two servers that rarely communicate, stands out as a warning sign.

Detection and early warning

Detection shortens the time attackers spend inside the network and can trigger at any step from 2 to 6. Behavioral monitoring learns how users, systems, and applications normally behave, and flags activity that breaks the pattern, which catches threats that signature-based tools miss.

Security teams typically feed those alerts into a security information and event management (SIEM) system, which collects signals from across the organization's systems in one place, so analysts can connect related events and respond faster.

The broader set of ransomware detection techniques also includes decoys. A network decoy mimics a legitimate backup target to lure attackers into revealing themselves before any real data is at risk.

Object First Honeypot is one example. It deploys a decoy Veeam Backup & Replication (VBR) environment within the Object First appliance in just a few clicks, serving as a tripwire to detect suspicious activity targeting backup infrastructure.

Backup and recovery

The four layers of protection above reduce the chance that an attack succeeds, but none of them determines what happens when one does succeed. That depends on the backup and recovery layer, where outcomes are getting worse: only 39% of organizations recovered at least 75% of their data after an attack, down from 57% in 2024. ^[2]

A cornerstone of data backup recovery is maintaining immutable backups, meaning that during a predefined time window, a backup cannot be altered or deleted. Care is needed here, though, because many systems that claim to offer immutable backups have hidden exceptions and loopholes.

The solution to these loopholes is Absolute Immutability, which means that even the most privileged admin, or an attacker with access to backup storage, cannot modify or delete data.

Absolute Immutability: The foundation of enterprise-grade ransomware protection

The gap between believing backups are protected and having that protection is wide: 76% of technology leaders say their primary backup solution uses immutable storage, but only 16% say their current backup storage is absolutely immutable. ^[2]

Absolute Immutability can only be achieved using a backup storage system that is “Secure by Design,” with Zero Access to perform destructive actions, and this Zero Access must be verified through third-party testing. ^[4]

One of the most common loopholes lies in how S3 Object Lock is configured. In Compliance Mode, retention periods are strictly enforced—even administrators cannot modify or delete protected data until the retention period expires. Governance Mode, on the other hand, allows privileged users to override Object Lock settings, so an attacker who gains administrative access can disable immutability and destroy backup data. ^[4]

Practical implementation of Absolute Immutability requires three core principles:

• S3 Object Storage: A fully documented, open standard with native immutability, enabling independent penetration testing and third-party verification.

• Zero Time to Immutability: Backup data becomes immutable the moment it is written, with no gaps and no landing zones.

• Target Storage Appliance: A dedicated appliance separates backup storage from backup software and removes the risks of DIY self-managed storage during setup, updates, and maintenance. No security expertise is required, because operational security shifts to the vendor.

By following these three principles, organizations can achieve Absolute Immutability, which keeps backup data protected and recoverable for its defined retention period, whether the threat is ransomware, an insider, or stolen credentials. ^[4]

Ransomware protection with Object First

When—not if—ransomware strikes, the future of your business hangs in the balance. In that moment, recovery matters most—getting back up and running as fast as possible, without unwanted complexity.

We make cyber resilience simple with backup storage that's absolutely immutable and purpose-built for Veeam. It's your ultimate defense against ransomware.

Object First is built on Zero Trust best practices and is third-party tested and verified to be secure. It's simple to deploy and manage with no security expertise required, and is powerful enough for lightning-fast backups and supercharged Instant Recovery to scale with your business.

When backup storage is this secure, simple, and powerful, you and your organization are Simply Resilient.

Object First's eight best practices for enterprise ransomware protection

At Object First, we're working towards a world where no organization has to pay a ransom for encrypted data. These are the eight ransomware protection best practices we recommend to every enterprise.

1. Enforce MFA on every remote and administrative account, starting with backup management consoles, and make no exceptions for partners, contractors, or service providers, because a single exempted account can compromise the whole network.
2. Give backup systems their own administrator accounts, separate from everyday user and domain administrator accounts, and apply least-privilege access so a harvested domain credential does not also open the backup console.
3. Require multi-person approval for destructive actions such as resets, retention changes, or security changes. An Eight-Eyes Protocol, with two customer-side individuals and two vendor-side staff members approving each action, closes the gap that a single compromised administrator account would otherwise create.
4. Encrypt backup data end-to-end from the moment it is created, using keys that change every backup session. Immutability stops attackers from altering or deleting backups, while rotating-key encryption keeps any backup data they steal unreadable.
5. Keep three copies of your data on two different media types, with one offsite, one immutable, and zero unverified backups, as the 3-2-1-1-0 backup rule specifies. Placing those copies in separate resilience zones, a core part of ransomware backup protection, means a breach of one zone does not reach the others.
6. Alert on retention policy changes, unusual deletion attempts, and failed authentication against the backup repository, and route those alerts to the same team and escalation path as production security alerts.
7. Test restores on a fixed schedule, covering critical systems quarterly and the full production environment at least annually, and record how long each one takes. An untested backup is an assumption, and the recorded time shows whether recovery meets your Recovery Time Objective (RTO).
8. Keep enough immutable restore points to recover from before the initial compromise, not just the visible attack. Attackers often maintain persistence for days or weeks before triggering encryption, so the most recent backup can already contain their foothold.

How to evaluate enterprise ransomware protection solutions

The recommendations above hold only if the storage underneath supports them, and many buyers never check whether it does. While 89% of technology leaders agree that vendor claims of immutability must be validated by a third-party audit, just 56% use third-party testing and reporting. ^[2]

The checks below enable an enterprise to test those claims before choosing among ransomware backup protection solutions, so the decision rests on evidence rather than a datasheet.

• Find out whether your vendor or most privileged administrator can shorten retention or delete a backup before it expires. If either can, an attacker holding the same credentials can too.

• Confirm that backup data becomes immutable the moment it is written, not only after the backup job completes, since any gap between the two leaves a window for tampering.

• Request published third-party penetration test results rather than relying on a datasheet claim. Independent testing is only possible against open, documented protocols, so a proprietary system leaves you relying on the vendor's word.

• Look at how the storage works with the backup software you already run, because storage built for that software removes the custom configuration work where self-managed setups often introduce vulnerabilities.

• Clarify who is responsible for patching, updates, and hardening, and how much security expertise your team needs to run the system safely. With self-managed storage, those operations and their risks stay with your team.

• Before you buy, test restore speed with your own data volumes and workloads, starting with the systems the business needs first, rather than relying on vendor benchmarks. The result shows how quickly you can recover data after a ransomware attack.

• Run a tabletop exercise that simulates a complete credential breach, in which an attacker holds every administrator account, including those for the backup software and storage. Then confirm in practice that the storage still refuses deletions and retention changes from those accounts. Only then can you be confident your backups are truly ransomware-proof.

FAQ

What is the best protection against ransomware for an enterprise?

No single control is sufficient; the best enterprise ransomware protection is layered. Among those layers, backup storage with Absolute Immutability is the one that still works after prevention and detection have failed, because no stolen account can shorten its retention.

How do you test whether your ransomware protection works?

Run restore tests on a schedule, record each restore time and compare it against your RTO, and hold tabletop exercises that assume an administrator account is already compromised. Then confirm that your backup storage actually refuses a deletion or retention change from that account, rather than relying on what the configuration screen shows.

What is the first thing to do in a ransomware attack?

Determine which systems are affected and immediately isolate them from the network, powering devices down only if they cannot be disconnected. [6] Isolation stops the spread while preserving the evidence your ransomware response plan needs for investigation and recovery.

References

[1] Askul Corporation. "Report on the Results of the Investigation into the Impact of the Ransomware Attack and Initiatives to Strengthen Security (13th Report)." December 12th, 2025 (Japanese). https://pdf.irpocket.com/C0032/PDLX/O3bg/N4O3.pdf

[2] Omdia. "Recovery without Compromise: The Data-Backed Case for Backup Storage with Absolute Immutability." Commissioned by Object First, June 2026. https://objectfirst.com/recovery-without-compromise/

[3] Sophos. "The State of Ransomware 2026." 2026. https://www.sophos.com/en-us/content/state-of-ransomware

[4] Object First. "Absolute Immutability: The Ultimate Ransomware Defense." White paper, 2025. https://objectfirst.com/absolute-immutability-whitepaper/

[5] National Institute of Standards and Technology. "NIST IR 8374 Rev. 1: Ransomware Risk Management: A Cybersecurity Framework 2.0 Community Profile." June 2026. https://csrc.nist.gov/pubs/ir/8374/r1/final

[6] CISA, MS-ISAC, NSA, and FBI. "#StopRansomware Guide." September 2023. https://www.cisa.gov/stopransomware/ransomware-guide