If your business suffered a ransomware attack today, could you recover your data — or would you be making a payment decision at 2 a.m.?

That is not a hypothetical question. 2026 has seen a steady stream of attacks targeting UK SMEs, and the pattern is clear: attackers now double-dip. They encrypt systems and exfiltrate data, then offer to return the data in exchange for a ransom. Existing backups either do not exist, have not been tested recently, or were themselves compromised during the initial breach.

For SMEs, the question is no longer if an attack will happen, but whether your recovery plan holds up. This article walks through what ransomware-resistant backups actually mean in 2026, what those five words require in practice, and where most SMEs fall short.

What Does "Ransomware-Resistant" Actually Mean?

The term is used loosely in marketing. In practice, a ransomware-resistant backup strategy meets three conditions:

1. Immutability — backups cannot be altered or deleted by anyone, including a compromised administrator account.

2. Isolation — at least one copy of your data resides in a location the attacker cannot reach during the initial breach.

3. Verifiability — you can demonstrate, within a defined recovery time objective (RTO), that the backup data restores cleanly and completely.

These are not features. They are conditions. Missing any one of them means your backups are not resistant to a modern ransomware attack — they are simply a file copy that may or may not survive.

The Three Layers of Effective Backups

A single backup location is insufficient. The practical model is three layers, each addressing a different failure mode.

Layer 1: On-Site Backup for Speed

This is your fast recovery path. A locally backed-up copy lets you restore small-scale data loss — a deleted file, a corrupted database — within minutes rather than hours.

Common on-site approaches include:

• Direct-to-NAS backup (e.g., Veeam to a Synology or QNAP appliance)

• Local Hyper-V/VMware backup repositories

• Fast-capacity servers holding recent recovery points

On-site backup is not your ransomware defence. It is your business-as-usual recovery tool. Because it lives on the same network as your primary systems, it is the first copy an attacker will seek to encrypt or delete.

Layer 2: Off-Site or Cloud Replication

An off-site copy addresses ransomware that reaches your local environment, hardware failure at your primary site, and regional disasters.

Options include:

• Cloud backup targets (e.g., AWS S3 with object lock, Azure Blob with immutability policies)

• Secondary off-site appliance or co-location

• Replicated VM snapshots to a cloud provider

The key requirement is that this copy is not reachable via the same credentials or network paths your attackers can access. If your cloud backups use the same Azure AD credentials as your on-site systems, you do not have isolation.

Layer 3: Air-Gapped or Immutable Offline Copy

This is your recovery guarantee. An air-gapped or offline copy is physically or logically disconnected from your production environment for a defined period.

Practical approaches for SMEs:

• Immutable cloud buckets with retention locking (WORM — Write Once, Read Many)

• Rotating offline drives that are physically disconnected between backup windows

• Backup appliances with built-in air-gap functionality

This layer is what turns a "backed up" environment into a ransomware-resistant one. If an attacker encrypts or deletes everything else, this copy is your last resort — and your strongest negotiating position.

Who Can Touch Your Backups?

The most common reason SME backups fail during a ransomware incident is credential compromise. Attackers do not need physical access. They need your domain admin credentials — and those are easier to obtain than ever through phishing, stolen tokens, or misconfigured service accounts.

If the compromised account has write or delete access to your backup infrastructure, immutability is an illusion. Immutable storage only works if the credentials accessing it lack modify or delete permissions.

Three practical steps:

1. Separate administrative accounts — use a dedicated backup admin account with no domain-level privileges.

2. Enforce least privilege on backup storage — the backup service account can write but cannot delete or modify immutable objects.

3. Monitor backup job logs — alerts on failed jobs, unexpected deletions, or credential changes are your early warning.

This is not theoretical. Organisations that reused domain admin credentials for both daily operations and backup management have repeatedly lost both their production data and their backup copies in the same incident.

Testing Backups: The Step No One Likes

A backup that has never been tested is not a recovery plan. It is a hope.

Ransomware-resistant backups require regular restore testing. This means:

• Scheduled restore drills — at least quarterly, restore a representative data set from your backup and verify integrity.

• Full-system restore exercises — at least annually, restore a virtual machine or server from backup in an isolated environment.

• Documented runbooks — recovery steps, tested and updated, so the person executing them at 3 a.m. is not starting from scratch.

Testing serves two purposes. It proves your backups actually work, and it means your team has walked through the recovery process before the clock is ticking.

Why 2026 Is Different

Several factors make this year a pivot point for SME backup strategy:

Double-extortion is now standard. Attackers rarely encrypt alone. They exfiltrate data first, then offer to delete or publish it. A good backup handles encryption. It does nothing for stolen data — except remove the payment incentive, because you already have what you need.

Ransomware-as-a-Service has lowered the barrier. Attack groups now operate like businesses, offering onboarding, support, and even SLAs. The cost of launching an attack against an SME has dropped to levels that were unheard of a few years ago.

Automation targets backups first. Modern ransomware includes routines that enumerate and encrypt every available backup target, including mounted network shares and certain cloud storage endpoints. You cannot outpace this with manual processes.

None of these trends are reversing. They are compounding.

Regulatory and Insurance Expectations

UK regulatory expectations around data resilience are tightening. The National Cyber Security Centre (NCSC) publishes guidance that aligns with the three-layer model outlined above. Insurers are increasingly asking for evidence of tested, immutable backups when underwriting cyber policies.

This is not about compliance for its own sake. Insurers and regulators are reacting to a simple observation: organisations with tested, isolated backups suffer materially less from ransomware attacks. That makes them lower risk. The market is starting to price that risk appropriately.

What matters for your SME is ensuring your backup strategy is documentable — you can show an insurer or auditor what you back up, how often, where the copies live, and when you last tested them.

Backup Gaps We See Across SMEs

Drawing from work with SME clients across Sussex and the wider UK, several patterns recur:

• Backups configured but never tested. The job runs green every night. Nobody has verified a restore in two or three years.

• Single-location backups. One NAS, one cloud bucket, one tape — and no off-site copy.

• Backup credentials with excessive privileges. The backup account can also reset passwords, delete accounts, and elevate its own access.

• Misunderstanding "the cloud means someone else backs us up." Synchronised cloud storage is not backup. If the attacker deletes files in OneDrive, and the cloud sync follows, the files are gone from every location.

• No documented recovery procedure. When an incident occurs, recovery becomes an improvised exercise under extreme time pressure.

Identifying any of these in your own environment is not a failure. It is the first step toward fixing the gap before the attack arrives.

What Should an SME Be Doing Now?

Start with the simplest audit possible:

1. List every backup target. Where does each backup live? On-site, off-site, air-gapped?

2. Check credential isolation. Can the backup account also access or modify production systems?

3. Verify immutability settings. Are retention locks or WORM policies actually active on your cloud backups?

4. Schedule your next restore test. Pick a realistic data set. Restore it. Confirm the data is correct.

5. Write a one-page recovery runbook. What steps do you take, in order, to restore a server from backup?

Working through these questions takes a few hours, not weeks. It reveals what you do not know about your own recovery posture — and that knowledge is far more valuable than any vendor's product brochure.

Common Questions

Can a small business afford ransomware-resistant backups?

Yes. The three-layer model does not require enterprise-scale spending. Many SMEs achieve this through a combination of a local NAS, an immutable cloud bucket, and an offline drive rotated on a schedule. The cost is typically measured in hundreds of pounds per month, not thousands.

Is Veeam ransomware-resistant by default?

No. Veeam is a tool. Whether it is ransomware-resistant depends on how it is configured. Features like immutable backup repositories and backup immutability windows must be explicitly enabled and correctly scoped. Configuration matters more than the product itself.

How often should we test our backups?

A practical cadence for most SMEs is a quarterly partial restore (a representative file set or application) and an annual full-system restore test. Adjust frequency based on how critical each system is to your operations.

What about ransomware that targets cloud backups?

This is a genuine risk. That is why isolation matters — your cloud backup credentials must not overlap with your production credentials. Separating service accounts and enforcing least privilege is your primary defence against this attack path.

Bottom Line

Ransomware-resistant backups are not a product you buy. They are a strategy you build and maintain. Three layers, tested regularly, protected by tight credential controls. That is the practical definition. Everything else is marketing.

If you would like a structured, low-pressure assessment of where your backup strategy stands against these benchmarks, we run a Security Triage baseline review that maps your current posture to this model — no commitments, no pressure, just clarity.

Book a Security Triage Call at /security-triage-baseline-review/book