Most enterprise backup evaluations are really backup software evaluations. Teams compare scheduling, policy engines, and dashboards, then treat storage as a place to put the data. Attackers see it differently. Once they hold admin credentials to the backup application, the storage underneath is the only thing standing between them and every recovery point you own.
A scalable enterprise backup solution has two layers: the software that runs the jobs and the storage where backups physically live. This list covers the eight storage-layer requirements that decide whether you can still recover after the software layer has been compromised, and how to test for each one before you buy. Along the way, it shows how ExaGrid Tiered Backup Storage meets each requirement, giving you a concrete benchmark to hold any vendor to.
Key Takeaways
- Enterprise backup needs independent defenses at both the software layer and the storage layer.
- Organizations whose backups were compromised paid the ransom at nearly double the rate: 67% versus 36% (Sophos, 2024).
- A non-network-facing retention tier keeps retained backups intact even after the backup application is compromised.
- Delayed deletes, immutable objects, and anomaly detection give the storage layer controls an attacker can’t switch off from the backup console.
- Scale-out storage keeps the backup window fixed as data grows by adding compute alongside capacity.
- ExaGrid Tiered Backup Storage meets all eight requirements, combining a non-network-facing Repository Tier, Retention Time-Lock, an undeduplicated Landing Zone, and scale-out appliances.
Why the Storage Layer Decides Whether You Recover
Backup software handles scheduling, policy, and orchestration. Tools in this category include Veeam, Commvault, Rubrik, HYCU, and Cohesity NetBackup. Backup storage is where the data actually lives and where retention is held for days, months, or years. If an attacker controls the backup application and the storage has no defenses of its own, delete commands sent from that application succeed, and every retained recovery point is gone.
Ransomware groups target backups because destroying them removes the victim’s alternative to paying. In Sophos research on compromised backups, based on a survey of 2,974 organizations hit by ransomware, those whose backups were compromised paid the ransom 67% of the time, compared with 36% when backups were intact. Only 26% of organizations with compromised backups fully recovered within a week, versus 46% of those whose backups were not affected.
The threat isn’t easing. Ransomware was again the most pervasive threat to US critical infrastructure in 2024, with complaints up 9% from 2023, according to the FBI’s 2024 Internet Crime Report. Backup recoverability is now a risk metric boards and insurers ask about directly.
1. A Non-Network-Facing Retention Tier
A tiered air gap places the retention tier off the network. The backup system can move data into it, but attackers on the compromised network can’t see or address it directly. Unlike tape or physical disconnection, the system stays online for legitimate restores.
This matches federal guidance. The CISA #StopRansomware Guide advises keeping offline backups because many ransomware variants search for accessible backups to delete or encrypt them.
What to test: Ask whether the retention tier has any network presence an attacker could reach with backup admin credentials.
2. Delayed Deletes
A delayed-delete policy holds every delete request for a set period before executing it, so an attacker’s delete command doesn’t immediately destroy backup data. ExaGrid’s Retention Time-Lock delays deletes in its Repository Tier for a configurable 1 to 30 days. At the 10-day default, the policy uses roughly 5% to 10% additional storage.
What to test: Issue a delete during a proof of concept and confirm the data is still restorable afterward.
3. Immutable Data Objects
Retention data should be stored as objects that can’t be overwritten or modified in place. If ransomware encrypts data in the landing area, or encrypted primary data gets backed up, prior retention points stay intact and restorable.
What to test: Confirm immutability is enforced by the storage itself, not only by a flag in the backup software that an admin could change.
4. Anomaly Detection with Dual Authorization
Attackers often delete in bulk. Storage that learns normal delete patterns can flag and stop abnormal ones. ExaGrid’s Auto Detect & Guard alerts the IT team when deletes fall outside the learned pattern and extends the delayed-delete hold indefinitely. Clearing that hold requires both an administrator and a security officer, each using two-factor authentication, so one compromised account can’t bypass it.
What to test: Ask how many separate credentials an attacker would need to purge retained backups.
5. Fast Restores Without Rehydration
Restore speed decides whether you meet your Recovery Time Objective (RTO), a core planning metric in NIST SP 800-34 Rev. 1, the federal contingency planning guide. Fast restores need recent data in a form that can be read immediately, while affordable retention needs data deduplicated. A single-tier design forces a trade-off between the two.
Inline deduplication processes data before writing it to disk, so every restore requires rehydration, reassembling data from deduplicated blocks. After a ransomware attack, that delay lands at exactly the wrong moment.
A two-tier design avoids the trade-off. ExaGrid’s Landing Zone holds the most recent backups in undeduplicated form, so restores, instant VM recoveries, and tape copies run without rehydration. Adaptive deduplication then moves data into the Repository Tier as deduplicated, immutable objects for long-term retention.
What to test: Measure instant VM boot time and full restore throughput from the most recent backup with your own workloads.
6. Scale-Out Growth That Keeps the Backup Window Fixed
Scale-up systems add disk shelves behind a fixed controller. Capacity grows, but compute and bandwidth don’t, so backup windows lengthen until the controller must be replaced in a forklift upgrade.
Scale-out systems add full appliances, each with its own processor, memory, bandwidth, and disk, so performance grows with capacity and the backup window stays fixed. ExaGrid supports up to 32 appliances in one system under a single interface, handling up to a 6PB full backup on HDD appliances or 17.3PB on SSD appliances. Appliances of different sizes and ages can be mixed, so hardware bought years apart works together.
What to test: Model five years of data growth and ask what happens to the backup window, and to your budget, at each step.
7. Multi-Application Support and Efficient Multi-Site Replication
Enterprise environments rarely standardize on one backup tool. An organization might run Veeam for virtual machines, Oracle RMAN for databases, and another tool for cloud workloads. Storage that works with all of them avoids running separate targets for each. ExaGrid supports more than 25 backup applications and utilities, so adding or changing backup software doesn’t mean replacing the storage layer.
For disaster recovery, replication between sites should send only deduplicated, changed data rather than full backup copies. That keeps WAN usage and costs manageable while still meeting recovery point objectives at the secondary site.
What to test: List every backup application and database utility you run today or plan to run within five years, and measure WAN traffic during a replication test.
8. A Support Model and Pricing You Can Verify
When a backup job fails at 2 a.m., a Level 1 queue that escalates to a generalist slows everything down. ExaGrid assigns each customer a senior Level 2 engineer who specializes in two to three backup applications, matched to the ones that customer runs. 99% of ExaGrid customers are on annual maintenance and support, and the company reports a +81 Net Promoter Score across more than 5,000 customers in over 80 countries.
Pricing matters just as much over a five-year life. ExaGrid’s annual maintenance covers installation assistance, failed-component replacement, and all software releases, and it offers five-year price protection.
What to test: Ask each vendor for its maintenance renewal rate, what annual maintenance includes, and whether future purchases are price-protected.
How the Main Backup Storage Architectures Compare
| Requirement | Scale-Up Deduplication Appliance | Cloud-Only Backup Target | Tiered Scale-Out Disk Appliance |
| Non-network-facing retention tier | Usually a single network-accessible tier | Off-premises, but reachable through APIs | Yes: retention tier is non-network-facing |
| Delayed deletes and immutability | Varies: some offer storage-level retention lock, others rely on backup software settings | Object lock available on many platforms; configuration dependent | Enforced at the storage layer, independent of backup software |
| Restore speed for recent backups | Rehydration required from deduplicated blocks | Limited by WAN bandwidth and egress costs | Full disk speed from the undeduplicated Landing Zone |
| Scalability model | Controller fixed; backup window grows with data | Elastic capacity; performance varies by tier | Compute and bandwidth grow with capacity |
| Backup application support | Varies by vendor | Varies; may require agent or workflow changes | 25+ applications and utilities |
How to Use This List in an Enterprise Backup RFP
Turn each requirement into a pass/fail question and ask every vendor to answer with a named mechanism or a measured number, not a general claim. Run the “what to test” checks during a proof of concept with your own backup jobs, because published benchmarks rarely match a specific environment’s data mix.
ExaGrid Tiered Backup Storage maps to all eight requirements: a non-network-facing Repository Tier with AI-Powered Retention Time-Lock and immutable objects, a Landing Zone for restores without rehydration, scale-out appliances that keep the backup window fixed, support for more than 25 backup applications, and an assigned Level 2 support model backed by a +81 Net Promoter Score.
Frequently Asked Questions
How much does enterprise backup storage cost per terabyte at different deduplication ratios?
Effective cost per terabyte depends heavily on the deduplication ratio, which varies widely by data type. Virtual machine images and repeated full backups usually deduplicate well, while databases and already-compressed or encrypted files deduplicate less. A tiered architecture lowers long-term retention costs by storing aged data at deduplicated rates while keeping recent backups undeduplicated for fast restores. Calculate cost at your own retention policy and data mix, not at a vendor’s best-case ratio.
How long does it take to recover a full environment from tiered backup storage after a ransomware attack?
Recovery time depends on data volume, network bandwidth, and how recent the clean restore point is. A tiered system with an undeduplicated Landing Zone removes rehydration time for the most recent backups, which are the most likely restore target. Instant VM recovery from the Landing Zone can bring critical systems back quickly, while full recovery across petabytes still takes hours to days.
What is the 3-2-1 backup rule, and does a tiered air gap satisfy the offsite copy requirement?
The 3-2-1 rule calls for three copies of data, on two different media types, with one copy offsite. A tiered air gap protects the on-premises copy but doesn’t replace the offsite copy. Replicate to a second site or cloud tier as well, since the air gap and the offsite copy protect against different failure scenarios.
How does tiered scale-out storage compare to a scale-up appliance for a 500TB environment?
At 500TB, a scale-up appliance may meet today’s backup window, but its performance won’t grow with your data. As the environment heads toward 1PB, the controller can become the bottleneck and backup windows lengthen. A scale-out system adds full appliances with their own compute, so the backup window at 1PB stays where it was at 500TB, without a forklift replacement.
How do I size backup storage for a multi-petabyte environment with 30-day retention?
Start with the full backup size, add daily incremental or synthetic full data for 30 days, and apply the expected deduplication ratio for each data type. In a tiered design, size the Landing Zone for recent undeduplicated backups and the Repository Tier for deduplicated retention. Undersizing the Landing Zone creates ingest bottlenecks, and undersizing the Repository Tier forces early retention pruning, so model both against your actual job sizes and change rates.
- Enterprise Backup Solutions: 8 Storage-Layer Requirements for Ransomware Recovery - October 10, 2026
- The Data Behind Comfort: How AI Is Optimizing HVAC Performance in Smart Buildings - September 11, 2026
- IT Forecasting and Planning Solutions That Connect Spend to Business Outcomes: Enterprise Edition - August 20, 2026
