A presales field note about the word “immutable” on a backup proposal — the tick box that does nothing on its own — and the checks I now run before I tell anyone their backups survive ransomware.

The requirement arrived as one line in a tender.

“The solution shall keep an immutable copy of all backups.”

The customer already owned a large deduplication appliance. Their backup team was confident.

“We have immutability. It’s in the job settings.”

I asked one question.

“If an attacker gets your backup admin password tonight — can they delete last week’s backups?”

A pause.

“Well… the admin can delete anything. That’s what admin means.”

That’s the trap. Immutability does not show up as a setting you switch on. It shows up as an action that nobody can perform — not the attacker, not the backup software, and not you.…