Ransomware incidents are usually described as encryption events. The encryption is the final step, and much of the preceding work is aimed at ensuring recovery is impossible.
Backups determine whether payment is considered
An organisation that can restore quickly treats the incident as an outage. One that cannot faces a choice between paying and rebuilding from nothing.
Attackers understand this, so removing recovery capability is what converts an intrusion into leverage. It is the step that makes the rest of the operation worth anything.
This is why the interval between initial access and encryption is often long. The time is spent on reconnaissance and preparation rather than on the encryption itself.
Connected backups share the compromise
Backup systems reachable over the network with administrative credentials are within the same trust boundary as the systems they protect. Compromising the domain compromises both.
Snapshots on the same storage platform, replicas in the same management domain and backup catalogues on joined servers all fall under this pattern.
The practical failure is that the backup existed and was verified, but the credentials that could delete it were available to whoever controlled the environment.
Immutability changes what deletion means
Storage that enforces a retention period at the platform level cannot delete or overwrite data before that period expires, even with administrative credentials.
The enforcement has to sit below the layer an attacker can reach, which is why the property must be provided by the storage system rather than by backup software policy.
Offline copies achieve the same outcome physically, since media not connected to anything cannot be reached by a network intrusion at all.
Data theft became the second lever
Because backups improved, attackers added extortion based on publishing stolen information. That threat is unaffected by how well an organisation can restore.
The result is that recovery capability limits operational damage but does not resolve the disclosure question, which has to be handled separately.
Restore speed is the number that matters
Having backups and being able to use them within an acceptable window are different properties, and the second is rarely measured until it is needed.
Restoring an entire estate involves rebuilding infrastructure, re-establishing identity systems and sequencing dependencies, which takes far longer than restoring a single server suggests.
Organisations that rehearse a full restore usually discover the constraint is not the backup at all but the order in which systems must come back.