Summarize this news article with AI:
Ask ChatGPT
Ask Grok
Ask Perplexity
Ask Claude
Ask Google AI How safe are your cloud backups? When ransomware strikes, less than a third of firms manage to recover all their data. Nearly half get less than three-quarters back.
Even when hackers aren’t infiltrating systems, IDC found that data can be lost to gaps between backups and backup-system failures.
For modern enterprises, successfully making copies of data is only part of the job. The recovery point, the integrity of the copy, and the ability to restore it quickly matter just as much.
But ticking off all those boxes is difficult when infrastructure is dispersed between on-premises systems and private and public clouds.
Cloud backup needs to support business resilience, and that increasingly means an architecture designed around isolation, recovery objectives, application consistency, testing, and the changing infrastructure that businesses depend on.
More Than Just Copies in the Cloud
Cloud backup is the practice of copying enterprise data from production environments to cloud-based repositories, so it can be restored in the event of a data loss or infrastructure failure. The principle is easy enough to understand, but the architecture enabling it can be complicated.
To start with, backup-to-cloud and cloud data storage aren't the same thing. Cloud storage is a place to keep data. A backup system adds policies, scheduling, retention, versioning, security controls and recovery mechanisms designed specifically to protect that data and restore it when required. It’s a crucial component of disaster recovery, which pulls together broader processes and infrastructure needed to bring business operations back online after a disruption.
Hybrid and multi-cloud environments complicate how backups are structured. Workloads could be running on a blend of physical servers, virtual machines, and cloud platforms, each of which will have different recovery requirements. For example, the database for a critical business application needs a tighter recovery point objective than a simple data archive. Treating both as identical opens up gaps that only become visible during an outage.
Why Cloud Backup Has Become More Complex in 2026
Cloud backup is harder to manage because IT environments have become harder to manage, in four acute ways.
Ransomware Targets the Backup
Ransomware operators know that the fastest way to increase pressure on a victim is to remove its ability to recover. Backup repositories, management consoles, and administrative credentials have become high-value targets because they enable hackers to attack the ability to recover.
That makes isolation a core requirement for enterprise cloud backup. Immutable copies, air-gapped storage and tightly controlled administrative access can significantly reduce the risk that attackers delete or encrypt backups along with production data – provided they are correctly configured and kept separate from production credentials.
Multi-Cloud Multiplies the Management Problem
Enterprise data is held in multiple environments, and each one can introduce different storage and recovery requirements.
Running a separate backup product for every single one can solve individual problems, but it also creates a larger one: fragmented management and limited visibility. A centralized approach can make it easier to apply consistent policies and monitor protection status.
The goal is to make the firm’s data protection strategy coherent across systems and platforms.
Regulation Adds Another Dimension
Regulations such as GDPR, DORA and HIPAA set expectations for data availability, backup and restoration, while privacy rules may also limit how long personal data can be retained. A backup strategy therefore has to balance recoverability with retention limits and deletion obligations. Enterprises operating across multiple regions may also need to accommodate different rules for data residency.
A cloud backup strategy needs to account for where data is stored, who can access it, how long copies are retained, and how quickly critical systems can be restored.
That makes centralized visibility and documented recovery testing extremely important. The backup infrastructure decisions you make now can affect both operational resilience and an organization's ability to demonstrate compliance.
The Building Blocks of a Resilient Cloud Backup Strategy
A sound cloud backup strategy starts with the assumption that, eventually, something will go wrong. The objective is to ensure that a single attack or failure can’t compromise production data and the copies intended to restore it.
These architectural principles make that possible:
Follow the 3-2-1-1-0 Rule
The familiar 3-2-1 backup rule calls for at least three copies of data, stored on two different types of media, with one copy kept off-site. The newer 3-2-1-1-0 model, widely promoted in the backup industry, adds one copy that is offline, air-gapped or immutable, and aims for zero errors after backup verification and recovery testing.
Cloud backup can make geographic separation and additional copies easier to achieve, but the underlying principle remains important: a backup that sits in the same environment, account or security domain as production can be exposed to the same failure.
Design Around RPO and RTO
Two metrics should shape backup decisions from the outset.
Recovery Point Objective (RPO). This defines how much data an organization can afford to lose, measured in time. An RPO of one hour means the business needs a recoverable copy no more than an hour old.
Recovery Time Objective (RTO). This defines how quickly systems need to be restored after an outage.
These requirements will vary across workloads. Applying the same backup policy everywhere can waste resources on low-priority data while leaving critical workloads under-protected.
Protect the Backups Themselves
A backup is only useful if attackers cannot simply delete or encrypt it.
Immutability prevents backup data from being altered or deleted during a defined retention period.
Air-gapped or logically isolated copies create additional separation from production systems.
Encryption protects data both in transit and at rest. Access controls and separate administrative credentials can further limit the damage caused by compromised accounts.
Make Backups Application-Aware
The backup strategy needs to look beyond the infrastructure hosting systems. Databases and other transactional applications may need backups that capture data in a state that’s usable by, and specific to, individual applications.
This becomes more important in hybrid environments where applications can span multiple systems and dependencies.
Test the Recovery, Not Just the Backup
A successful backup job tells you a copy was created. A successful recovery test tells you the copy is actually usable.
Regular recovery testing should verify that critical applications and data can be restored within their defined RTO and RPO. It can also expose problems that backup dashboards cannot: missing dependencies, incorrect permissions, corrupted copies or recovery procedures that exist on paper but fail under real conditions.
Cloud Backup for VMware Environments and What Happens When You Migrate
VMware environments tend to benefit from mature integrations between the hypervisor and enterprise backup platforms. Many backup solutions use VMware's vSphere APIs for Data Protection (VADP) to create image-level backups of virtual machines without requiring a backup agent inside each guest operating system.
That makes VMware backups relatively straightforward to manage at scale, but it also creates a dependency.
When workloads move from VMware ESXi or vSphere to an alternative hypervisor, existing backup workflows may no longer work as expected. VADP, for example, is designed for VMware environments, so a backup architecture built around VADP APIs can’t just be moved to another hypervisor.
This leaves a protection gap when a migration is underway. The production workload may have moved successfully, while the backup strategy remains tied to the infrastructure it just left.
The risk is particularly easy to overlook because backup is often treated as a separate operational function. During a major infrastructure migration, however, the backup architecture needs to move with the workloads.
Check Backup Compatibility Before Migration
Any enterprise planning a VMware migration should ask if the existing backup solution can protect and restore workloads on the target platform.
That means checking support for the specific hypervisor, including alternatives such as Sangfor aSV before migrating production workloads. The evaluation should cover both backup and recovery capabilities, since support for creating a backup does not necessarily guarantee equivalent restore functionality.
If the existing platform does not support the target environment, an alternative or supplementary backup solution should be validated, ideally in a pilot, before production workloads move.
Protecting the Backup Investment
Choosing a backup platform that supports VMware and other hypervisors can reduce dependency by offering a consistent management layer. Jobs and policies usually still need to be re-established for migrated workloads, and teams should plan how legacy restore points will be retained during the transition.
For organizations planning VMware replacement, hypervisor compatibility is a core part of the business case for migration.
The simplest way to avoid a backup gap is to treat data protection as part of the migration architecture from the beginning.
Cloud Backup Best Practices for Enterprise Environments
A cloud backup strategy that looks solid on paper can still fall over when the business needs it. The difference usually comes down to execution.
Five practices should be non-negotiable for enterprise environments:
01 Test Recovery, Not Just Backups
Test recovery regularly and set the frequency according to workload criticality. Many organizations test their most critical applications quarterly or more often. Verify that the data is intact, applications come back cleanly, and recovery teams know what to do. A backup that has never been restored is an assumption, not evidence.
02 Encrypt Everything
Customer-managed encryption keys provide greater control over who can access backup data, although key management needs to be designed carefully. An inaccessible encryption key makes a perfectly healthy backup just as useless as a corrupted one.
03 Lock Down Backup Administration
Use role-based access controls to limit who can create, modify, delete or disable backup jobs. Separate administrative accounts and tightly controlled privileges can make it harder for compromised credentials to turn a ransomware attack into a backup disaster.
04 Monitor Every Backup Job
Automated monitoring should flag incomplete jobs, unexpected changes in backup duration or volume, and other signs that protection isn’t operating as expected. Alerts should reach someone who can act on them.
05 Rehearse the Recovery
Document recovery procedures and rehearse them. Conduct technical recovery tests. Identify dependencies, access requirements, recovery priorities, and the people responsible for each step.
Cloud Backup Strategy Checklist for Enterprises
| Component | What It Does | What Enterprises Should Check |
| 3-2-1-1-0 backup rule | Maintains multiple copies, including an isolated or immutable copy, and verifies recoverability | Are copies stored across separate media or environments? Are recovery tests producing zero errors? |
| Recovery Point Objective (RPO) | Defines how much data the business can afford to lose | Does backup frequency match each workload’s data-loss tolerance? |
| Recovery Time Objective (RTO) | Sets the target time for restoring systems after an outage | Can critical applications be restored within their required recovery window? |
| Immutability & isolation | Helps prevent attackers from deleting or altering backup copies | Are backups protected from compromised production credentials and administrative accounts? |
| Application consistency | Helps ensure restored applications and databases are in a usable state | Does the solution support application-aware backups for critical workloads? |
| Hybrid & multi-cloud coverage | Protects workloads across on-premises, private-cloud and public-cloud environments | Can policies and recovery workflows cover all required platforms? |
| Hypervisor compatibility | Maintains protection when workloads move between virtualization platforms | Does the backup solution support both VMware and the target hypervisor, including restore operations? |
| Recovery testing & monitoring | Confirms that backups are usable and failures are detected promptly | Are jobs monitored, failures investigated, and recovery procedures tested regularly? |
A resilient cloud backup strategy depends on more than choosing a storage destination.
How How Sangfor and Its Data Protection Partners Support Enterprise Recovery
The best backup strategy is only as good as the infrastructure underneath it. Sangfor HCI provides the infrastructure layer, integrating compute, storage, and networking through aSV, aSAN, and aNET, with security services such as aSEC available on the platform. For organizations that want to keep their existing storage and networking, aSV is also available as a standalone hypervisor
Enterprises can use aSAN snapshots to create local recovery points for quick rollback after events such as failed updates or configuration errors. Because snapshots reside on the same storage cluster as production data, they complement rather than replace isolated, off-platform backups.
Sangfor integrates with Veeam Backup & Replication for image-level VM backup, application-aware protection and recovery across on-premises and cloud environments. Its support for immutable backup repositories adds another layer of protection against ransomware. Veeam supports both VMware and Sangfor aSV, which allows teams to manage protection for both environments from one platform during a migration. Feature parity between hypervisors should be confirmed for each use case.
Through its global strategic partnership with Cohesity, which now includes the former Veritas business, Sangfor offers enterprises a further option for data resilience, management and security across distributed environments.
To manage it all, Sangfor Cloud Platform (SCP) serves as the centralized management layer for compute, storage, networking and security resources, giving operations teams a single view of infrastructure health. Backup and recovery are managed through the partner platform, such as Veeam or Cohesity.
Sangfor provides the infrastructure while Veeam and Cohesity provide the data protection layer. SCP helps teams keep an eye on the environment underneath it. Together, they help enterprises build a data protection strategy that is designed with recovery in mind.
For enterprises reviewing their cloud backup strategy, VMware migration plans or broader data resilience architecture, Sangfor Cloud Platform is the logical place to start.
FAQ
Cloud backup is the practice of copying data from an organization’s production environment to a separate cloud-based storage environment so it can be recovered after data loss, corruption, ransomware, or infrastructure failure.
Cloud backup creates recoverable copies of data and systems. Disaster recovery is the broader strategy for restoring applications, infrastructure, and business operations after a disruption.
The 3-2-1 backup rule recommends keeping at least three copies of important data, using two different types of storage media, with at least one copy stored off-site. The 3-2-1-1-0 approach extends this by adding an offline or immutable copy and regular testing to verify that backups contain no errors and can be recovered successfully.
Ransomware can target backup infrastructure as well as production systems. Attackers may attempt to encrypt, delete or otherwise compromise backup copies before disrupting the primary environment.
Check that the backup solution supports both your existing VMware environment and the target platform, including backup and restore capabilities. Look for consistent management across hypervisors, application-aware protection, support for your required cloud or object-storage targets, immutability and recovery testing.
