Protect and secure your data from cyber attacks
Data Protection
Data Security
Data Insights
The 5 Steps to Cyber Resilience
Cloud & SaaS
Enterprise
Industries
Ransomware operators target backups first. If they can encrypt or delete your recovery data, restoration stops being an option and paying the ransom starts looking like the only way out. Immutable backup storage closes that door, which is why it has become a baseline requirement across enterprise data protection.
Most backup vendors now offer immutable storage, but the way they deliver it varies significantly. Some enforce immutability within the backup platform itself, while others depend on underlying storage services or customer-managed controls. These differences can affect security, operational complexity, and recovery confidence when ransomware strikes.
This comparison looks at how Cohesity, Rubrik, Commvault, and Veeam approach immutability, highlighting the strengths, tradeoffs, and recovery considerations behind each design.
Immutable storage is backup data that cannot be modified, encrypted, or deleted until a defined retention period expires. Once an immutable backup is written, the data is protected by a retention lock enforced at the storage or file system layer, preventing even highly privileged users from changing or removing it through normal operations.
This protects recovery points from ransomware, compromised administrator accounts, insider tampering, and accidental deletion. It also supports compliance requirements that call for records to remain unchanged for a defined retention period.
Traditional backups, immutable backups, and air-gapped backups each play a different role in a cyber resilience strategy. Organizations are increasingly combining all three to help ensure they can recover quickly and confidently when an incident occurs.
Traditional backups are the baseline. Data is copied to disk, tape, or cloud storage on a regular schedule and remains readily available for recovery. While this approach works well for routine issues such as hardware failures and accidental deletions, it assumes the backup environment itself remains secure. As a result, users with sufficient privileges can modify, overwrite, or delete backup data, creating a potential risk if attackers gain administrative access to the environment.
Immutable backups add a retention lock at the storage layer that helps defend against ransomware by keeping backup data online and quickly recoverable while blocking any user or process from altering or deleting it during the lock period. This defeats the ransomware playbook of encrypting or wiping backups before triggering the production payload. The tradeoff is that immutability alone does not protect against a compromise of the backup platform's control plane or a physical event that takes out the entire environment.
Air-gapped backups add physical or logical isolation. A copy of the backup data lives in an environment that has no persistent network path to production, whether through offline tape, a disconnected vault, or a cloud-isolated tenant with tightly controlled access windows. Air gaps protect against attackers who compromise the primary backup platform and against site-level disasters, but recovery is slower, and the isolated copy is typically less current than the online immutable copy.
Traditional backups
Immutable backups
Air-gapped backups
Protects against
Hardware failure, accidental deletion
Ransomware encryption, malicious deletion, insider tampering
Full backup platform compromise, site-level disasters
Falls short against
Any attacker with admin credentials
Control plane compromise, physical loss of the environment
Slower recovery, less current data
Recovery speed
Fast
Slower
Data freshness
Current
Point-in-time snapshot
Role in the strategy
Operational restore
Primary ransomware defense
Last-resort recovery vault
A layered approach puts each control where it does the most work. Traditional backups handle day-to-day operational restores. Immutable backups defend the online recovery data against ransomware and malicious deletion. Air-gapped copies sit behind both as the recovery of last resort when the primary environment cannot be trusted.
Rubrik centers its immutability strategy on Atlas, the distributed file system that stores backup data. Atlas keeps recovery points inside the Rubrik platform in an append-only format, while Retention Lock protects the policies that govern how long those recovery points remain available.
Atlas stores backup data in an append-only file system that is not exposed as a standard writable SMB or NFS share. That reduces the attack surface by limiting direct access to the backup repository and prevents existing recovery points from being overwritten after they are written. If ransomware encrypts production systems or later backups capture infected data, previously protected recovery points remain unchanged.
Retention Lock protects backup retention policies from being shortened or removed before they expire. This prevents an attacker who gains administrative access to the backup platform from bypassing immutability by deleting the policy instead of the backup data itself. The protection applies only to workloads assigned to a Retention Lock-enabled SLA, so organizations must apply it to the policies they want protected.
Commvault delivers immutable backup storage by combining platform controls with storage-native immutability across supported disk, object, and cloud storage. Depending on the deployment architecture, immutability can be enforced by Commvault or by the underlying storage platform, while features such as Air Gap Protect extend protection with an isolated recovery copy.
Air Gap Protect creates an isolated recovery copy in a separate cloud environment managed independently from the primary backup infrastructure. The service is designed to preserve a clean recovery path if ransomware compromises the production environment or the primary backup platform, while reducing the operational overhead of building and managing a separate vault.
Commvault supports WORM protection across its own storage platform and a broad range of third-party storage. Organizations can therefore deploy immutability within Commvault or use controls such as Object Lock on the underlying target, depending on the architecture they choose.
Veeam gives customers multiple ways to deploy immutable backup storage, with the most common being a Hardened Linux Repository for local recovery points and object storage with S3 Object Lock. The software coordinates backup and retention, but the customer chooses the repository design and remains responsible for securing the infrastructure around it.
A Hardened Repository uses a dedicated Linux host to hold backup files and block their removal during the configured immutability window. Single-use credentials are used during deployment, so the Veeam backup server does not retain ongoing administrative access to the repository. This reduces the damage a compromised management server can cause, although the customer still owns the Linux hardening, patching, access controls, and physical or virtual host security.
For object storage, Veeam writes backup data to a bucket configured with S3 Object Lock in Compliance mode. The object-storage service then prevents protected versions from being deleted or having their retention shortened before expiration, including through privileged administrative accounts. The model extends immutability into cloud repositories, but it requires customers to provision the bucket correctly and account for the storage and retention consequences of a lock that cannot be reversed early.
Cohesity protects backup data across the storage, administrative, and recovery layers. DataLock helps protect backup recovery points from modification or premature deletion, while FortKnox maintains an additional immutable copy in an isolated cyber vault. Together, these capabilities provide fast access to local recovery points and a trusted recovery path if the primary environment is compromised.
DataLock applies write-once-read-many (WORM) protection to protected recovery points, preventing them from being modified or deleted until the defined retention period expires. Recovery operations work from cloned data rather than altering the protected backup itself, helping preserve the integrity of the original recovery point.
Cohesity separates DataLock administration from general backup administration through the Data Security role. Multi-person authorization can also require quorum approval for designated sensitive actions, preventing one compromised or malicious account from making critical security changes alone. This adds threat protection against credential theft and insider abuse without affecting routine backup and recovery operations.
FortKnox maintains an immutable copy of backup data in a Cohesity-managed cloud vault separated from the customer’s production and primary backup environments. A virtual air gap restricts access to controlled transfer windows, helping keep vaulted data outside the normal attack path. This provides organizations with a trusted recovery source when ransomware compromises production systems, backup infrastructure, or a site-level event takes the local environment offline.
Immutable backup comparison: where each approach leads
Category
Rubrik
Commvault
Veeam
Cohesity
Immutability approach
Append-only storage within the Atlas file system
Platform controls combined with WORM enforcement from supported storage targets
Linux file immutability or storage-native S3 Object Lock
DataLock enforcement within the SpanFS file system
Retention/policy safeguard
Retention Lock protects selected SLA policies from premature changes
Varies by platform feature and storage configuration
Single-use credentials can limit persistent access to hardened repositories
Dedicated security roles and multi-person authorization protect sensitive changes
Isolated recovery option
Rubrik Cloud Vault: managed, immutable, logically air-gapped cloud copy
Air Gap Protect: managed isolated cloud copy
Veeam Data Cloud Vault: managed, immutable, logically air-gapped cloud copy
FortKnox: immutable copy in an isolated cyber vault
Access controls
Quorum authorization and MFA available as configurable options
Access controls vary by storage target configuration
Four-Eyes Authorization and MFA available as configurable options
Quorum or MFA is enforced by default, tied to a dedicated security role separate from general backup administration
Customer responsibility
Apply Retention Lock to the required policies; enable quorum/MFA if desired
Select and correctly configure the underlying storage controls
Deploy, harden, patch, and maintain self-built repositories; Data Cloud Vault reduces this for the managed option
Define protection policies and select the appropriate FortKnox deployment
In this immutable backup comparison, Rubrik’s strength is its tightly controlled, append-only repository. Commvault stands out for storage flexibility, while Veeam gives infrastructure teams greater control over repository design. Cohesity delivers the broadest integrated approach, combining native file-system immutability with protected administration and isolated recovery.
Immutability helps ensure that recovery data cannot be modified or deleted when attackers target backups. But resilient recovery requires more than protected data. Organizations must also secure the policies, access controls, and recovery processes that surround it.
A trustworthy recovery path depends on having a clean, protected copy of data that remains available even if production systems, administrative credentials, or parts of the backup environment have been compromised.
Immutability, retention safeguards, and isolated vaulting each play a different role in cyber resilience, and vendors implement them differently at the file-system level, the storage-target level, or through a combination of both. Cohesity's approach layers DataLock immutability within SpanFS, role-separated administrative controls, and isolated recovery through FortKnox, giving organizations a recovery path they can trust even if the primary environment is compromised.
Explore Cohesity's backup and recovery capabilities and ransomware solutions to learn how a layered approach to cyber resilience helps organizations recover securely and confidently at enterprise scale.
