What is an immutable backup?

An immutable backup is one that cannot be altered or deleted for a set retention period, even by an administrator:

• It exists because attackers go for backups first - encrypting live data is only leverage if the restore path is also gone.
• The lock is enforced by the storage - not by a policy or a permission that a stolen credential can change.
• Retention is chosen up front - long enough to outlast the time between a compromise and its discovery.

Ask your backup provider whether immutable retention is available on your plan; on many it is a setting rather than an upgrade.