Altria Achieves 100x Faster Cyber Recovery with Rubrik

The goal was a single platform with one support contract, one audit report, and a tested ransomware recovery plan across the full environment.

Before evaluating any vendor, the team defined what the platform had to do. Four non-negotiable capabilities: air-gapped architecture with backups isolated from the production network, immutability with backups locked at the platform level so a compromised admin credential cannot disable protection, anomaly detection built into the platform to scan for ransomware and provide clean recovery points, and unified compliance reporting across the enterprise.

Other platforms evaluated met some of these requirements but delivered them as bolted-on features across multiple portals. Rubrik met all four within a single platform, covering on-premises workloads, cloud, and Identity.

Altria never framed Rubrik as a backup tool. From the first conversation, the team treated it as a cyber resilience platform, which put it in front of a different set of decision-makers, drew sponsorship from the CISO and IT Risk Management rather than infrastructure budgets, and elevated the program to board-level reporting.

For a Fortune 500 company in a heavily regulated industry, a breach is not a technology problem. It is a business risk. When internal teams pushing back questioned why a separate platform was needed when they already had backups, the architecture team ran a structured evaluation and presented the results to the CISO. The structured evaluation gave stakeholders the confidence to move forward.

The questions the team set out to answer now have results behind them. Across all sites, Altria achieved 100% SLA compliance. Cyber RTO is 100 times faster than before. Where identifying a clean recovery point once required days of forensic work across multiple tools, Altria can now rapidly scan backups and recover directly without restoring data first. Retiring multiple tools and consolidating onto one platform delivered more than 30% in operational savings vs. the legacy on-prem environment, with an additional 19% vs. native cloud backup.

The same goals that drove the Enterprise Data Protection consolidation applied to Identity. In an environment running across Active Directory, Entra ID, and multiple IAM platforms, the team needed a platform that could recover the full AD forest, not just files and registry entries, to meet the bar for any serious incident response scenario.

On-premises Active Directory and Entra ID are two distinct identity planes. Restoring them out of sequence breaks access across cloud applications and on-premises systems simultaneously. Most organisations protect one plane and assume the other is covered. Altria needed a platform that handled both, in the right order, with dependency relationships between identity objects visible so recovery sequencing could be planned rather than reconstructed under pressure.

Before Rubrik Identity Resilience, recovering identity infrastructure required 22 manual steps spanning multiple days, with teams correlating identity object dependencies by hand. With Rubrik, those dependencies are visible within the platform and recovery runs directly from backup. Recovery that previously took days now happens in hours, with verified clean recovery points across both AD and Entra ID.

With each acquisition and expansion, the identity footprint grows - more service principals, more managed identities, more SaaS integrations. Protecting them is not a one-time project. It is an ongoing requirement that grows with the business.