Veeam
A backup is only the part you can restore
Veeam's position in the market rests less on capturing data than on getting it back: verified restores, recovery tested automatically, immutable copies that ransomware cannot reach, and the same tooling across virtual machines, physical servers, cloud workloads and Microsoft 365.
Where backup programmes actually fail
Almost no organization discovers that it has no backups. What it discovers, under pressure, is that the backups exist and cannot be used: the job had been failing quietly for eleven weeks, the restore takes four days at the available bandwidth, or the backup server was on the same domain as everything else and was encrypted alongside it.
That last case is now the common one. Ransomware operators locate and destroy backups before triggering encryption, because doing so is what converts an incident into a payment. A backup reachable with the same credentials that just compromised the estate is not a recovery plan.
The discipline these failures point to is unglamorous: verify that restores work, keep at least one copy out of reach, and know the recovery time before the day you need it.
Controls that address each failure
| Control | What it does | Failure it prevents |
|---|---|---|
| Immutable copies | Backups cannot be altered or deleted for a set period | Backups destroyed in the attack |
| Automated restore verification | Recovers backups in an isolated environment and confirms they boot | Discovering corruption during a crisis |
| Instant recovery | Runs a workload directly from the backup while it restores | Days of downtime during a full restore |
| Separated credentials | Backup infrastructure held outside the production domain | One compromise reaching both |
| Microsoft 365 backup | Captures mail, files and sites the platform does not retain for you | Assuming the cloud is a backup |
| Documented recovery time | Measured, not estimated | A plan nobody has tested |
The rule worth applying
The convention Veeam popularised is three copies of the data, on two different media, with one copy off site, one copy offline or immutable, and zero errors after verification. It is memorable because each clause corresponds to a specific way recovery fails in practice.
Questions this lets you answer
| Question | Typical answer today | With verified backup |
|---|---|---|
| When did a restore last succeed | Unknown | Last night, automatically |
| How long to recover the file server | An estimate | A measured figure |
| Could ransomware delete the backups | Probably | Not within the retention lock |
| Is Microsoft 365 covered | Assumed by the platform | Backed up separately |
| Would the insurer accept this | Untested | Evidenced |
Qualification, stated plainly
Veeam suits mixed estates: some virtualised servers, some physical, some cloud, and Microsoft 365 alongside. Breadth under one console is the practical argument, and it grows stronger the more varied the environment is.
It is heavier than a small organization with a handful of cloud-only workloads needs. It also requires ownership: immutability and verification are configuration choices, not defaults that appear on installation, and a deployment where nobody enabled them delivers the same false confidence as the product it replaced.
Book the recovery review
A short session establishing when a restore was last tested, where the copies live, and whether the credentials protecting them are the same ones an attacker would obtain first.
Book the reviewGet in touch with Your Company
Questions about this solution? Reach us directly.