Backup and ransomware recovery

Backups decide how a ransomware attack ends. If clean copies of your data and systems survive, the business can restore and keep going. If the attacker found and encrypted or deleted the backups first, which is now a standard step in most attacks, the choices get much worse. The tools in this category keep those copies and help you get machines running again.

Small businesses usually need to cover three kinds of data. Servers and virtual machines are backed up as full images, so a failed machine can be rebuilt or even started from the backup itself. Laptops and desktops hold files that never reach a server. SaaS data, such as Microsoft 365 mail, OneDrive and SharePoint, or Google Workspace, needs its own backup, because the provider keeps the service running and offers only limited ways to recover deleted or encrypted data.

The feature that matters most against ransomware is immutability. An immutable backup can't be changed or deleted for a set period, even by an admin account. Combined with at least one copy stored off site or in a separate cloud account, it means a stolen admin password is not enough to wipe out every backup. The common rule is three copies of your data, on two kinds of storage, with one off site.

AI and automation show up in a few places. Some tools watch backup data for signs of mass encryption and alert you, which can be an early warning of an attack. Others scan backups for malware before a restore, so you don't bring the infection back, or test backups automatically by starting them in an isolated environment.

Featured AI security tools: backup and ransomware recovery

SponsoredBackup and ransomware recovery This position is open Put your tool at the top of the backup and ransomware recovery page. Paid spots are always labeled Sponsored. From $99 a month. Get featured

What a featured listing costs · from $99 a month

9 AI security tools in backup and ransomware recovery

Acronis Cyber Protect

by Acronis

Backup combined with anti-malware and patching in one agent, with cloud storage and a console built for MSPs.

Works with Microsoft 365
Works with Google Workspace
Multi-tenant console for MSPs

Veeam Data Platform

by Veeam Software

Backup and recovery for virtual machines, physical servers, cloud workloads and Microsoft 365, with immutable copies.

Works with Microsoft 365
Free plan or free edition

Druva

Cloud backup service for laptops, servers and SaaS data such as Microsoft 365 and Google Workspace, with no backup hardware.

Works with Microsoft 365
Works with Google Workspace

Axcient

Backup and disaster recovery for MSPs, with cloud virtualization of protected servers and Microsoft 365 backup.

Works with Microsoft 365
Multi-tenant console for MSPs

Cove Data Protection

by N-able

Cloud-first backup from N-able for servers, workstations and Microsoft 365, managed by MSPs from one web console.

Works with Microsoft 365
Multi-tenant console for MSPs

Keepit

Backup for SaaS data such as Microsoft 365, Entra ID, Google Workspace and Salesforce, kept in Keepit's own data centers.

Works with Microsoft 365
Works with Google Workspace

Afi

SaaS backup for Microsoft 365 and Google Workspace with policy-based setup and ransomware detection on backed-up data.

Works with Microsoft 365
Works with Google Workspace
Multi-tenant console for MSPs

Datto BCDR

by Kaseya

Backup appliances and cloud for MSPs that can boot a failed server from its backup, locally or in the Datto cloud.

Multi-tenant console for MSPs

Backblaze

Computer backup for business laptops and B2 cloud storage with object lock, often used as an off-site target for backups.

When you compare tools, think about how long you can be down. Restoring a large server from cloud storage over a normal office connection can take days. Tools that keep a local copy, or can run a failed server in the vendor's cloud while you rebuild, shorten that time. Ask how a full restore of a whole machine works.

Check what each tool covers. Some handle servers and SaaS data in one console, and others do one or the other. Ask how retention is set, where data is stored, how it is encrypted and who holds the keys. If an MSP runs your backups, ask to see a restore test report.

Protect the backup system itself. Use separate accounts with multi-factor login for backup admin, keep backup servers off the main domain where you can, and limit who can change retention settings.

Test restores on a schedule. A green success message only tells you a job ran. Restoring a full machine, opening the files and timing the process is the only way to know a backup will work when you need it.

Questions about backup and ransomware recovery

Doesn't Microsoft or Google already back up our data?

They keep their services running and keep deleted items for a limited time, but that is not the same as a backup you control. If an attacker or a mistake deletes or encrypts data, recovery options are limited. A separate SaaS backup keeps your own copies for as long as you choose.

What is an immutable backup?

It is a backup copy that can't be changed or deleted for a set period, even by an administrator. It protects against attackers who steal an admin account and try to wipe backups before launching ransomware. Many tools and cloud storage services here offer it.

How often should we test a restore?

Many companies test a full restore of at least one important system each quarter, and file restores more often. Test after big changes too. Time each test, so you know how long a real recovery would take.

Is cloud backup enough on its own?

For laptops and SaaS data it often is. For servers, restoring everything from the cloud can be slow, so many small businesses keep a local copy for fast restores and a cloud or off-site copy for disasters. The right mix depends on how long you can afford to be down.