This blog shares a practitioner's perspective on evolving data protection and ransomware resilience in Azure Cloud. It is based on a video testimonial of an Infrastructure Leader at a financial-services organisation.

Our organization manages significant endowment and operating assets, so when we decided to move from on-premises infrastructure to Azure, getting data protection right wasn't optional. The hard part wasn't going to be the migration itself. The hard part was going to be figuring out what we were leaving behind, and what we still needed that no one had built for the cloud yet.

Our previous solution was solid for on-premises. But when we took that leap into Azure, it became clear quickly that "solid for on-premises" and "ready for the cloud" were two very different things. Azure does offer its own native backup capabilities, and yes, we looked at them. What we found was limited control and no real-time visibility. You're restoring a backup, but you're not seeing the details of what actually happened. You're not getting file-level metrics. You're stuck in snapshot land.

The mechanics of Azure-native recovery tell that story well. To get to a file, you have to recover a managed disk, mount that managed disk, make a disk out of it, and then add that to a VM. There are so many levels. What should be a straightforward recovery turns into a multi-step manual process where a lot can go wrong at each step.

That's when we started looking for something cloud-first. Rubrik was cloud-first. That was really where the journey began.

One of the first things I noticed after deploying Rubrik was how different my mornings became. Before, our automated backup messaging was cryptic. Getting into the product to actually see what was protected was a long process. You'd look at the output and not really know what you were looking at.

Now, backup status review is a daily task, and I mean that in the best way. I go in, everything's green, and I move on. When there are reds, I know immediately, and more importantly I know exactly what I need to do to resolve it and what caused it. That's not just VM backups. That's M365. That's SQL. That's Azure DevOps pipelines. That's everything, across the board, in one place.

That shift from cryptic alerts to clear, actionable visibility sounds like a quality-of-life improvement. It's actually a security posture improvement. When you can't read your backup status, you can't act on it

We had moved storage accounts into our cloud environment, replacing the NAS infrastructure we'd managed on-premises, and that expansion of the attack surface was something we thought about seriously. Rubrik's ability to bring all of that under one umbrella was important. But the ransomware detection capability was what I'd call the golden ticket.

Here's what that looks like in practice: Rubrik mounts and indexes backups, which means I'm getting file-level metrics I never had before. More importantly, if Rubrik Threat Monitoring detects a ransomware file before I even know it's there, it flags it and can quarantine it. I can restore my entire environment with that file quarantined. It doesn't exist in the recovered state. You don't have to choose between restoring and being clean. You get both.

We had a moment that tested this in a real way. We saw an alert on the Rubrik dashboard that looked suspicious, enough that we decided to bring in more partners. We called Rubrik. Within about six minutes, we had a full SOC team online with us, walking through every backup, everything we had protected. It turned out to be a false positive, which was a relief. But what stayed with me was the speed and the depth of the response. Six minutes to a full SOC team. That kind of support is not what you expect from a backup vendor.

One of the less-discussed benefits of maturing your backup and recovery practice is what it does for organizational confidence. Before Rubrik, when we were doing major production changes, there wasn't much confidence at the leadership level that we could reliably roll back if something went wrong. That uncertainty sits in the room during every significant infrastructure project.

Over time, we were able to demonstrate recovery capability at multiple layers of our environment, repeatedly, through different scenarios. That's how I earned the confidence of my leadership and stakeholders. It wasn't a presentation. It was proof. 

The way I think about this work has shifted over the last decade or so, and especially since we moved to the cloud. A lot of people still frame backup and recovery as a DR function, something you hope you never need, maintained by the infrastructure team in the background. I think that's wrong, and I think it creates real risk.

Every instance where a backup wasn't taken, that's data loss. That's a security incident. These things are so close together that treating them as separate disciplines doesn't make sense anymore. We need to break down the barriers between infrastructure and information security and bring those teams together. That's how backup and recovery gets to the next level.

The way I put it: No matter how big or small your organization is, you need to marry backup and recovery to security. That's the way it should have been from day one.