Data backup and resilience: Building cyber recovery into core of enterprise systems

Immutable backups, rapid recovery, hybrid architecture, and identity separation form the backbone of modern resilience strategies in an AI-driven threat landscape.

Organisations across the Middle East are operating in an environment where cyberattacks, infrastructure instability, and regulatory complexity intersect. Backup is no longer a secondary IT function. It is operational insurance — and, increasingly, a strategic pillar of business continuity.

Ransomware actors now target recovery environments as aggressively as production systems. At the same time, national data sovereignty requirements, cloud dependency, and AI adoption introduce new architectural considerations. Resilience demands a deliberate shift from simple backup routines to comprehensive recovery strategies.

Backup Alone Is Not Enough
Fred Lherault, CTO EMEA/Emerging at Everpure, reinforces the need for a broader approach and said, “Backing up data remains critical for data protection, but it’s not enough. Implementing advanced data protection capabilities helps companies better plan for — and recover quickly from — ransomware and cyberattacks. This essentially requires a two-pronged approach: taking regular, immutable, and indelible copies of data, and having the necessary infrastructure to rapidly restore from backups at speed and scale.”

Immutable and indelible copies ensure data cannot be altered, encrypted, or deleted — even if administrative credentials are compromised. In a ransomware event, organisations can restore clean versions of critical systems without negotiating with attackers.

Protection, however, is only half the equation. Recovery speed determines business impact. Modern flash-based storage platforms now enable restoration at scale — often reaching hundreds of terabytes per hour — reducing downtime from weeks to hours and significantly limiting operational disruption.

Independence Determines Availability
Ziad Nasr, General Manager for Acronis Middle East, argues that backup must be treated as core operational infrastructure rather than an add-on service.

During a crisis, failure often begins with identity systems, connectivity, or centralised management layers. When backup platforms rely on the same credentials, network paths, or control planes as production systems, recovery can become inaccessible at the moment it is most needed.

Administrative separation is essential. Dedicated accounts, strict privilege control, and strong authentication reduce exposure when credentials are stolen. Geographic distribution further strengthens resilience. Combining local recovery copies for rapid restoration with offsite or cross-region replicas mitigates concentration risk and limits the impact of facility outages or regional disruptions.

Disaster recovery (DR) strategies must extend beyond data restoration. Secondary recovery sites and cross-cloud failover capabilities allow critical workloads to restart in alternate environments if primary infrastructure becomes unavailable.

“Recovery should be exercised against realistic disruption scenarios. Simulating prolonged outages or loss of a primary site reveals operational gaps before a real crisis does. Backup is valuable only if it remains accessible and usable when infrastructure is under pressure, and DR is effective only if workloads can be restored and operated in an alternate location without relying on the compromised environment,” said Nasr.

Testing Under Constraint
Recovery exercises often assume full connectivity and stable conditions. Real-world incidents rarely unfold so neatly.

Organisations must validate restoration processes under constrained scenarios: limited bandwidth, offline identity systems, restricted facility access, or partial network outages. Full-site failover testing confirms applications and services can operate in alternate environments rather than merely restoring raw data.

National infrastructure disruption introduces additional risk factors, including power instability and backbone connectivity loss. Diversification across facilities, providers, and jurisdictions reduces exposure to single points of failure. Cross-border or multi-cloud DR architectures provide controlled recovery options when regional disruption or regulatory restrictions interfere with operations.

Local restore capabilities, documented offline procedures and clearly defined escalation paths reduce reliance on fragile external dependencies during instability. DR environments capable of independent operation for defined periods offer an additional safety net.

Navigating Data Sovereignty and AI Dependency
Andreas Hassellöf, Chief Executive Officer at Ombori, highlights the architectural complexity created by regional data sovereignty laws. Regulatory requirements often concentrate infrastructure within a single geography, increasing exposure during disruption.

Hybrid strategies offer a balanced path. Compliant regional storage can be paired with structured redundancy models, selective on-premise capabilities and edge computing nodes supporting critical workloads.

AI adoption introduces further dependency on external providers. Capacity constraints or service interruptions affecting large language models can disrupt customer-facing and operational workflows. Maintaining a selective on-premise AI inference infrastructure enhances operational continuity while supporting privacy and low-latency processing requirements.

Cloud delivers scale and efficiency. Long-term resilience requires architectural flexibility across multiple infrastructure models.

Immutable Foundations for Business Continuity
Immutable backup anchors recovery integrity. When data is written in a format that cannot be altered or deleted, even elevated threat activity cannot compromise the recovery point. Destructive malware frequently attempts to target backup repositories directly. Immutability ensures a verified, trustworthy restoration baseline.

“When data is written in an immutable format, it cannot be altered or deleted even if administrative credentials are compromised. During periods of elevated threat activity, destructive malware and ransomware attempts often increase, including attempts to target backup repositories directly,” said Hassellöf.

“Immutable storage ensures that organisations retain a verified recovery point. It anchors restoration processes and restores confidence in system integrity. In an AI-accelerated threat environment, trusted recovery mechanisms form the foundation of business continuity,” added Hassellöf.

Comprehensive resilience planning integrates:

• Hybrid infrastructure models
• Regular recovery testing under realistic scenarios
• Immutable backup strategies
• Clearly defined recovery time objectives (RTOs) and recovery point objectives (RPOs)
• Cross-region or cross-cloud failover options
• Segregated identity and administrative controls

Prepared organisations design continuity across multiple disruption scenarios — cyber, infrastructural and regulatory.

In an AI-accelerated threat landscape, recovery integrity is no longer optional. Trusted backup, rapid restoration and architectural flexibility form the foundation of enterprise resilience.