By the Time You See the Ransom Note, Your Backups Are Already Gone
Cyber Defense Magazine, Thursday, July 23rd, 2026
With a 29-day median ransomware dwell time, every restore point in a typical retention window is already compromised.
Mandiant's M-Trends 2025 report puts median ransomware dwell time at 29 days when organizations discover the intrusion themselves.
A typical configuration of daily incrementals with a seven to fourteen day rolling window means every restore point was created while the attacker was present.
Sophos found only 54% of organizations with encrypted data restored it from backup, the lowest rate in six years.
GFS retention extends recovery options past realistic dwell times, but only Compliance-mode Object Lock prevents deletion by a compromised admin, root user or the backup software itself.