A backup can complete successfully and still be vulnerable to deletion by an attacker who gains administrative control. Protecting recovery means securing both the stored copies and the systems, accounts, and network paths that can change or destroy them. A successful job report answers whether a copy was made; it does not establish whether that copy will survive a compromise.
The October 20, 2026 SafePay ransomware advisory gives MSPs and IT directors a concrete reason to review that distinction. The useful discussion is about who can destroy recovery options, which controls restrict that authority, and who will investigate an unexpected change.
What the SafePay advisory establishes
In their joint SafePay advisory, the FBI, CISA, US Secret Service, and international partners describe attacks affecting businesses and critical infrastructure across several regions, including North America. They report that the actors halt the Volume Shadow Copy Service and reset network-attached storage containing backup data to factory settings to hinder recovery.
This is a report of observed activity, not evidence that every SafePay incident follows the same sequence. The advisory recommends offline backups, tested restoration, protected backup data, restricted privileges, segmentation, and monitoring. It also describes data theft: restoring systems does not resolve the separate consequences of stolen information.
Protect the administration behind the copies
Our assessment is that a backup review should examine two paths together: the path that writes the data and the administrative path that can erase it. A storage system can receive its scheduled backups correctly while its management interface remains accessible from an unnecessarily broad part of the business network.
Consider an explicitly hypothetical branch with a backup appliance. Its nightly report is green, but ordinary workstations can reach its management console, and a production administrator also holds unrestricted backup privileges. That report offers no evidence about the consequences of compromising the administrator's account. The review should identify the allowed management sources, the privileges required for destructive operations, and the protections that remain if a production account is compromised.
The Canadian Centre for Cyber Security's ransomware playbook recommends segregating backup-administrator duties from production administration. It also explains the value of disconnected backups and restore testing. These are useful operational principles for this review, not a claim that Canadian guidance imposes a requirement on every US organization.
Ask what “immutable” means in the actual configuration
A storage label needs a configuration-level explanation. Amazon S3 Object Lock illustrates why: governance mode permits users with special permissions to override retention protections. Compliance mode prevents deletion or alteration of a protected object version during its retention period, including by the account's root user; AWS documents account deletion as an exception. The modes therefore address different administrative powers.
This is a platform-specific example, not a statement about every backup product. For your selected system, establish which copies are protected, how long protection lasts, who can change it, and what happens after expiry. An independent location and a retention lock answer different questions. Neither should be inferred from a dashboard showing that a backup job completed.
Use approved configuration review and a disposable test dataset to validate the relevant behavior. Do not try deleting a production recovery point to find out whether its protection works. Separately demonstrate that an authorized operator can restore usable data; resistance to deletion and successful restoration need separate evidence.
Make the network and monitoring responsibilities explicit
Network Box USA's managed UTM service combines firewall policy, intrusion prevention, logging, updates, and operational support. Where backup-management traffic crosses the managed enforcement point, agreed policies can restrict access to approved sources and services. That scope must be established from the actual network design; an edge gateway cannot enforce a path that never crosses it.
Our included SIEM capability, within qualifying Edge Defense and NBX MDR services, supports log collection, correlation, detection rules, and SOC review. During service design, determine whether the relevant backup-system events can be collected and which changes warrant investigation, such as unexpected administrative access or altered retention settings. Agree the escalation contact and response authority; do not assume a particular backup integration is included.
The customer or its backup provider owns backup creation, storage protection, retention, encryption, and restoration testing. Network Box USA's published responsibility mapping preserves that division. A useful outcome is a shared understanding of which team protects each access path and which team verifies recoverability.
To review the network restrictions and monitoring responsibilities around your backup environment, contact our team.