阅读约 5 分钟
83% of Organizations Keep an Offsite Backup, Yet Nearly Half Leave It Online and Vulnerable to Ransomware
QNAP's Enterprise Cyber Resilience Survey 2026 asked 1,838 organizations across 93 countries how they protect their data. On backup, the picture looks reassuring at first: 1,534 of them, or 83%, keep an offsite copy. The trouble is where that copy lives. At 896 organizations, the backup server stays connected to the network around the clock, and nothing stops a stolen administrator account from deleting it. That's 49% of everyone surveyed.
It would be easy to assume these are the laggards. They aren't. Of those 896, 323 already score Established or above on overall security maturity, and 53 have more than 1,000 employees. Strong security everywhere else doesn't mean the backup is safe.
In a 2024 Sophos study of 2,974 IT and security professionals whose organizations had been hit by ransomware, 94% said attackers tried to compromise their backups, and 57% of those attempts succeeded. Once the backup was compromised, the numbers changed fast. The share of victims paying the ransom rose from 36% to 67%, and median recovery costs jumped from $375,000 to $3 million, eight times higher. Having a backup is no longer the finish line. Protecting it is. It's worth asking whether a backup policy written a few years ago still holds up against how attackers operate today.
Follow the 3-2-1-1-0 Rule, and Prove Your Backups Can Be Restored
Three copies, two types of media, one offsite: the 3-2-1 rule was built for failed drives and flooded server rooms. Ransomware works differently. Once attackers get inside, they move laterally across the network, hunting for critical data and every backup of it they can reach. 3-2-1-1-0 adds two conditions aimed squarely at that. At least one copy must be offline, isolated, or immutable, and restore tests must come back with zero errors.
The survey shows most organizations have the first half of the 3-2-1-1-0 backup rule covered. The gaps are in the last two steps—1 (Air-Gap & Immutability) and 0 (Zero Errors):
- Air-gap isolation: 56% keep their offsite or cloud backup servers continuously connected to the network, within reach of any attacker who gets inside. Only 26% have physically isolated their backups.
- Data immutability: 26% have no protection preventing a compromised privileged account from deleting or altering their backups.
- Restore testing: Only 26% run scheduled integrity checks and regular restore tests. The rest test manually and occasionally, or never verify their backups at all.
Restore testing matters more than it looks. The more practiced your restore process is, the faster you're back on your feet after an attack.
Completing 3-2-1-1-0: Close the Last Two Gaps with QNAP HDP for Business and Airgap+
Simply “having a backup” is no longer enough. To master the critical 1 (offline/immutable) and 0 (zero errors) of the 3-2-1-1-0 rule, enterprises need proactive defense. QNAP HDP for Business consolidates fragmented backup systems into a single platform, turning your QNAP NAS into a centralized backup hub. By pairing Airgap+ isolation with 100% restore verification, it guarantees a clean, usable fallback during attacks—eliminating the fatal trap of "backup success, restore failure."
Airgap+ automatically powers down the backup server outside scheduled backup windows, keeping it physically offline. While it's offline, attackers can't reach it over the network, let alone delete or encrypt it.
QNAP also offers immutable backup via QuTS hero WORM folders. Once data is written, it's locked, and not even an administrator can change or delete it during the retention period. An attacker who gains the highest privileges in your organization still can't erase that copy.
A backup job that reports success says nothing about whether the data will actually restore. HDP for Business closes that gap with automated recovery verification. After each job, it runs a restore and boot test on the backup server and records the results, including a video of the boot screen and system logs, without disturbing production. For ISO 27001 certification or internal audits, these records give auditors concrete evidence that restores work, in place of manual logs. Backups can also be replicated to QNAP storage services, such as on-premises QuObjects or cloud-based myQNAPcloud Object, or to S3-compatible clouds such as Amazon S3 and Wasabi, creating an offsite, immutable copy.
Cyber Resilience Health Check: 3 Questions to Find Where Your Backup Strategy Falls Short
IT and security decision-makers should verify these three key questions before deciding on their next backup upgrade:
-
Is your backup server connected to the network most of the time?
-
If an admin account were stolen, could your backups be deleted?
-
When did you last complete a real restore?
Wondering where your organization stands in cyber resilience? Explore QNAP 2026 Enterprise Cyber Resilience Survey: Download the Full Report for Free
The report evaluates self-assessment data from 1,838 organizations across 93 countries, assessing eleven controls across four critical areas: data protection and backup, identity and access control, threat monitoring and active defense, and business continuity and recovery. Results are broken down by region, company size, and industry, so you can compare yourself with your peers. The report also sets out which measures to prioritize at each maturity tier, giving you actionable next steps.
