Why “we have backups” is no longer a strategy

DISCLAIMER: This article is provided for educational and informational purposes only. It does not constitute legal, regulatory, or insurance advice.

Project Hail Mary, Ransomware Edition

Early in Project Hail Mary, Ryan Gosling’s character, Ryland Grace, wakes up alone in space. No memory. No crew. No margin for error. Just one realization: If the plan fails, there is no backup plan.

That moment lands because it mirrors reality. Not Hollywood reality. Business reality.

In cybersecurity, ransomware response, and disaster recovery, many organizations believe they have a Project Hail Mary—their backups. And like Grace floating in space, they don’t discover the truth until everything else is gone.

“I’m not a hero,” Gosling’s Grace says later in the film. “I just don’t want to die.”

Most businesses don’t want to be heroes either. They just don’t want to lose their data, reputation, or company.

Yet that’s exactly what happens when backups are not immutable.

Backup Myth That Won’t Die

You’ve heard it. Maybe you’ve said it.

“We’re fine. We have good backups.”

Many experts still tout that a “good backup” is all you need against ransomware, data loss, or even the total loss of a facility.

That advice is dangerously incomplete.

Here’s the uncomfortable reality we see repeatedly in real incidents:

1. Attackers don’t rush encryption. They wait.
2. They watch backup jobs run for weeks—or months.
3. They tamper with backup configurations, so jobs show successful… while protecting nothing.
4. Or worse, they wait for a panicked administrator to log into the backup console during an incident.
5. Credentials are stolen.
6. Backups are deleted—instantly.

At that moment, your last line of defense disappears.

And even if backups do survive, they are still the last hope, not the first solution:

• Replacement hardware must be sourced.
• Operating systems rebuilt.
• Platforms reinstalled.
• Security re-hardened.
• Data restored and validated.

Backups are not recovery. They are the final chapter, not the opening scene.

Immutable Backup, Explained Like You’re Not an Engineer

Immutable backup in one sentence for a layperson:

Immutable backups are backups that cannot be changed, deleted, or tampered with—by hackers, admins, or even you—until a preset time expires.

Think of it like this: Once the backup is written, it’s locked in a vault with a timer. No keys. No overrides. No “oops.”

In Project Hail Mary, survival depended on systems that worked even when the human failed.

Immutable backup works the same way.

Why Hackers Target Backups First

Attackers are rational. They don’t want drama. They want leverage.

Encrypting production data is easy. Destroying recovery options is how they win.

We’ve seen:

• Backup retention set to 7 days… quietly changed to 1 day.
• Backup repositories wiped clean in seconds.
• Cloud backups deleted via compromised admin tokens.
• Office 365 mailboxes “restored” to an already-empty state.

When backups are mutable, they are just another system—and systems can become corrupt, deleted, or simply fail.

Immutable backup removes the deletion option.

Project Hail Mary Correlation: No Undo Button in Space

There’s a moment in the movie where Grace realizes a calculation error could doom the entire mission. There’s no rollback. No snapshot. No second chance.

“If this fails,” he mutters, “that’s it.”

That’s exactly how ransomware incidents feel when backups are compromised.

No drama. Just silence.

Immutable backup is the difference between:

• We hope this works and
• We know this cannot be taken away.

Overwatch Cybersecurity 2026: Why We’re Mandating Immutability

As part of Overwatch Cybersecurity 2026, we are implementing immutable backup as a baseline control.

Not as an upsell. Not as a “nice to have.” As a requirement.

Clients may opt out—but only by explicitly accepting all liability and risk, acknowledging that their backups are vulnerable to compromise.

Because hope is not a strategy.

Microsoft Azure Backup: Immutable by Design (When Configured Correctly)

Azure Backup, when implemented properly, provides immutability through vault-level controls and soft delete protections that cannot be bypassed casually.

Core Implementation Steps (High Level)

1. Create a Recovery Services Vault
2. Enable Soft Delete
3. Enable Immutable Vault Settings
4. Set Role-Based Access Control (RBAC)
5. Configure Long-Term Retention
6. Monitor Backup Integrity

Once immutability is enabled and locked, even Microsoft administrators cannot simply remove data.

That’s the point.

Hidden Tradeoff: When Backups Are Locked, They’re Locked

Here’s the part many vendors don’t tell you.

When you use immutable backup with long retention:

• Old servers
• Decommissioned databases
• Obsolete file shares

…don’t just disappear.

You must formally request removal through Microsoft support if the data is no longer relevant or required for business.

That’s not a bug. That’s the cost of real protection.

In Project Hail Mary, resources were finite. Every decision mattered. In cybersecurity, retention decisions matter the same way.

ConnectWise Backup for Microsoft Online Services (Office 365)

Email, OneDrive, SharePoint, and Teams are prime ransomware targets.

Deleting backups here is devastating because:

• Legal discovery fails.
• Executives lose mail history.
• Regulatory penalties multiply.

We implement immutable retention policies within ConnectWise Backup for Microsoft Online Services to ensure:

• Backups cannot be purged early.
• Retention aligns with business and legal needs.
• Administrative access is tightly controlled.

Office 365 data is often assumed “safe because it’s Microsoft.” That assumption has cost companies millions.

Microsoft provides availability—not recovery strategy.

Another Movie Parallel: Waiting Too Long to Act

In Project Hail Mary, survival depends on acting before catastrophe, not after.

Ransomware is no different.

Immutable backup must be:

• Enabled before compromise.
• Locked before credentials are stolen.
• Tested before panic sets in.

You cannot turn it on mid-incident.

Last Hail Mary You Thought You Had

Without immutability, your last Hail Mary—your backup—may not be there when you need it.

The safety net you imagined?

• Cut.
• Deleted.
• Never actually capturing data.

And just like in space, there’s no rewind.

“I choose to solve problems,” Gosling’s Grace says near the end of the film.

Immutable backup is choosing to solve the problem before it becomes existential.

Final Thought: Discipline Beats Hope

Backups alone are not enough. Cloud alone is not enough. Experience alone is not enough.

Discipline is.

Immutable backup is not exciting. It doesn’t demo well. It doesn’t make headlines—until it saves your company.

And when everything else fails, you don’t want a hope. You want a lock.

Because in cybersecurity, as in space:

There is no undo button.

👉 Take the 1-minute quiz to see if you’re taking an expensive gamble on your IT and your business. Then schedule your Cyber Risk Analysis.

Published by Kevin Fream

Many people don't understand their current situation and become frustrated in business and life, so I created the Delta Method and wrote the #1 Best-Seller "Change Your Game" - as featured at Harvard and NASDAQ as well as national TV news. Streamline your technology for competitive advantage using vetted IT support and take a divergent approach to personal growth. View all posts by Kevin Fream