The immutability gap: Why 93 percent of companies demand immutable backups – but only 16 percent actually have them
93 percent of IT decision-makers consider immutable backups indispensable. However, only 16 percent actually have a backup environment that meets this requirement. This gap, revealed by a recent market study, illustrates a key trend in ransomware recovery in 2026: The crucial factor is no longer whether a company has a backup, but whether it can withstand a targeted attack. The difference between true and perceived immutability increasingly determines whether a ransomware incident remains a brief business interruption or escalates into a crisis lasting for weeks.
Table of Contents
Omdia study reveals immutability gap in backups: 93 to 16 percent
On August 31 and again on September 3, 2026, the analyst firm Omdia published a study that reveals the backup reality in companies with alarming clarity: 93 percent of the IT decision-makers surveyed consider "Absolute Immutability"—an architecturally guaranteed, tamper-proof immutability of backup data—to be critical. In reality, only 16 percent have a backup storage environment that demonstrably meets this standard.
The study also shows how much the threat landscape has intensified: 83 percent of companies fell victim to a successful ransomware attack within 24 months (2024: 66 percent). Only 39 percent were subsequently able to recover at least 75 percent of their data (2024: 57 percent), and only 39 percent achieved a recovery time of no more than five days (2024: 49 percent).
The reality of these figures is illustrated by the case of the Berlin state administration: Following the Rhysida group's ransomware attack on two Senate departments in August 2026, IT systems were isolated for weeks and gradually restored , while approximately 5,79 terabytes of data were published on the dark web. Security experts like Manuel Atug also attributed the severity of the incident to structural flaws in the IT security architecture – an example of how costly a backup architecture becomes when it cannot withstand a targeted attack.
What distinguishes a true immutable backup from supposed immutability?
The term "immutable backup" is often used liberally – not every solution advertised as "immutable" lives up to its name. The Omdia study therefore distinguishes between "absolute immutability" and merely logical, software-based immutability.
With purely logical immutability, the restriction on changes is enforced via software rules – within the same system accessed by regular administrative users. If these credentials are compromised, for example through phishing as in the Berlin case, the attacker can, in the worst-case scenario, lift the restriction. Absolute immutability, on the other hand, is architecturally embedded: The backup data resides on a separate, hardened storage layer that cannot be overwritten, encrypted, or deleted, even with administrative rights on the production system.
This distinction is not merely an academic subtlety: 84 percent of the companies surveyed by Omdia with ransomware experience reported multiple service interruptions – an indication that many implemented security mechanisms failed to withstand a targeted attack. Not every company that believes it maintains immutable backups has actually closed this gap.
The economic cost to companies of the immutability gap
The economic consequences are significant. Companies with truly immutable, isolated backups achieve significantly shorter recovery times and complete data restoration more often than those whose supposedly immutable backups fail a real stress test. The decline in the recovery success rate from 57 to 39 percent within a year—despite an increasing attack rate—indicates that attackers are more specifically targeting the backup environments themselves, which are intended as the last line of defense, than ever before.
In addition, there is a problem of trust in the supplier market: According to the study, 89 percent of IT decision-makers demand independent validation of manufacturer claims regarding immutability, instead of relying on marketing statements – an indication that “immutable” on the data sheet does not automatically mean real protection.
Why immutable backups are the foundation of every resilience strategy
For years , BS I has recommended the 3-2-1-1-0 rule: three data copies on two different media types, one of which is stored externally, one immutable or physically separate (offline/air-gapped), and zero unchecked recovery errors. Research shows how crucial the fourth and fifth components have become: verifiable immutability and regularly documented recovery tests.
A backup architecture that consistently implements these principles is not an additional security feature, but rather the fundamental prerequisite for being able to act in an emergency. Companies with an architecturally secure, tested, and independently verifiable backup infrastructure thus move from the group of 61 percent unable to fully recover their data to the group for whom a ransomware attack remains a business disruption that can be overcome – not an existential crisis.
Expert view: Why the immutability gap is an architectural problem, not a problem of awareness
The discrepancy between aspiration and reality cannot be explained by a lack of awareness of the problem – 93 percent of decision-makers understand the importance of immutability. The real problem lies in the historically evolved architecture of many backup environments, which were optimized for availability and speed, not for defense against targeted, administratively privileged attackers.
The Berlin case provides a vivid example: An internal protocol, documented as early as 2026, noted that the necessary security infrastructure was not fully implemented – with well-known consequences. Security experts unanimously consider such cases to be structural failures, not individual misconduct. For companies, this means that what matters is not whether the IT department understands the importance of immutable backups, but whether the implemented architecture technically meets this requirement – demonstrably and independently verifiable.
Recommendations for action: How companies can close the immutability gap
The first step is an honest assessment: Is it a software-based lock within the same administrative area, or an architecturally separate, hardened storage layer that cannot be overwritten even with compromised admin access? This question should not be answered based on manufacturer specifications, but through technical testing or independent validation – this is precisely what the majority of IT decision-makers now demand.
Equally important is the consistent implementation of the 3-2-1-1-0 rule – not as a one-off project, but as a continuously monitored standard, including regular, documented recovery tests . Only a actually tested recovery process provides reliable information about the realistic recovery time in a crisis – not theoretical assumptions.
Finally, the backup environment should be treated as an independent security target, separate from the general IT security strategy: its own access controls, its own monitoring, and architectural separation from the production systems, so that a compromised administrator account in the production network is never enough to compromise the backup level as well.
Conclusion: True immutable backup is not optional, but a basic requirement for ransomware recovery.
Current research shows that the debate surrounding immutable backups will reach a turning point in 2026. Almost all decision-makers acknowledge the necessity – the real challenge lies in fulfilling this requirement technically and architecturally, rather than relying on supposed immutability. Those who consistently take this step will gain measurable benefits: higher recovery probability, shorter downtimes, and a backup that delivers on its promise in a crisis. The Berlin case demonstrates what is at stake if this gap remains unfilled.
Frequently asked questions about immutable backups and absolute immutability
What does "Absolute Immutability" mean in the context of backups?
Absolute immutability is an immutability that is architecturally anchored on a separate, hardened storage layer – backup data cannot be overwritten, encrypted or deleted there, even with compromised admin access data of the production system.
How does this differ from a "normal" unchangeable backup setting?
Many solutions advertised as immutable enforce the lock only at the software level, within the same system to which regular administrators have access. If attackers steal these credentials, the lock can, in the worst case, be lifted – with absolute immutability, this is architecturally impossible.
According to a recent study, why do only 16 percent of companies have truly immutable backups, even though 93 percent consider them necessary?
The gap lies less in awareness of the problem than in historically grown backup architectures that were designed for availability and speed rather than for defending against targeted, privileged attacks – a real implementation often requires an architectural reassessment of the backup infrastructure.
What does the cyberattack on the Berlin state administration have to do with this topic?
This case demonstrates how costly an inadequately secured IT and backup architecture can be: Despite isolation and restoration of the systems, large amounts of data were stolen and published – according to security experts, also due to structural shortcomings in the security architecture.
What does the BSI rule 3-2-1-1-0 state regarding data backup?
The rule recommends three data copies on two media types, one of which is stored externally and one is immutable or physically separate (offline/air-gapped), as well as zero unchecked errors during recovery – i.e., regularly tested recovery processes.
How can companies verify that their backups are truly immutable?
It is recommended to conduct a technical review to verify that immutability is based on an architecturally separate storage layer, to independently validate the manufacturer's specifications, and to perform regular, documented recovery tests that demonstrate real-world recovery capability.
Act now – we are your partner for Absolute Immutability
The discrepancy between required and actual immutability is rarely objectively assessable internally – this requires an independent technical review of the backup architecture. This is precisely where the experts at Cristie Data come in: with a vendor-independent analysis of existing backup and recovery environments and proven approaches for absolute immutability and recovery testing. A no-obligation consultation will help you realistically assess your current status and determine the necessary steps.
Note: AI-powered tools were used to assist in the creation of this article. Research, editorial review, and content responsibility lie with the editors of Cristie Data.
