# What is an immutable backup?

An immutable backup is a copy that cannot be changed or deleted until a set retention period has passed, not even by an administrator account. It is usually achieved with write-once storage: object storage with a retention lock in compliance mode, a hardened backup repository that refuses deletion, or tape that is physically removed. The point is ransomware: attackers who gain admin rights routinely try to delete or encrypt backups before they encrypt production systems, so that the victim has no way back except paying. With an immutable copy, that step fails. Check three things when a vendor says immutable: whether the lock can be shortened or removed from the same console an attacker could reach, how long the retention lasts, and whether the storage provider's own support can override it. Immutability protects against deletion, not against backing up already-infected data, so keep several restore points.

FAQ: [Backups and recovery](https://netsenx.com/en/faq/backups) · https://netsenx.com/en/faq/what-is-an-immutable-backup

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/blog/2026-10-24_ransomware-protection

## Related questions

- [What is an offline or air-gapped backup?](https://netsenx.com/en/faq/what-is-an-offline-or-air-gapped-backup)
- [How often should we test a restore?](https://netsenx.com/en/faq/how-often-should-we-test-a-restore)
- [Do ransomware gangs go after backups first?](https://netsenx.com/en/faq/do-ransomware-gangs-go-after-backups-first)
- [Why is a backup mapped as a network drive a risk?](https://netsenx.com/en/faq/why-is-a-backup-mapped-as-a-network-drive-a-risk)
- [Which computers should be able to connect to the backup server?](https://netsenx.com/en/faq/which-computers-should-connect-to-the-backup-server)