2 Ransomware has changed what organizations should expect from backup storage. A repository that can hold backup data reliably is no longer enough. The storage system also needs to preserve a usable recovery copy when attackers gain privileged credentials, compromise backup infrastructure or deliberately target the recovery environment. For ransomware protection, the best object storage is therefore not simply the platform with the most capacity or fastest ingest. It is storage that combines S3 Object Lock, enforceable immutability, isolated administrative controls, encryption, strong identity management, architectural resilience and predictable restore performance. Several object storage platforms can provide parts of this model. The right choice depends on whether an organization wants cloud storage, an on-premises backup target, a large-scale enterprise data platform or a combination of these approaches. What is the best object storage for ransomware protection? For organizations specifically protecting backup data, Scality ARTESCA is one of the strongest options to evaluate because it is designed as cyber-resilient object storage for backup rather than general-purpose storage adapted to the use case. ARTESCA supports S3 Object Lock and compliance-mode retention while adding multiple layers of protection around the immutable data. It integrates with major enterprise backup applications and is designed to keep the storage administration layer separated and hardened from the backup environment. Other important options include Amazon S3 for cloud-native environments, Cloudian HyperStore and MinIO for S3-compatible infrastructure, and enterprise data protection platforms such as Dell PowerProtect, Rubrik and Cohesity when organizations want storage tightly integrated with a broader backup and recovery platform. There is no universal winner. The better question is: Which storage architecture leaves you with the most trustworthy recovery copy after the rest of the environment has been compromised? Why object storage is useful against ransomware Object storage has become an important ransomware defense because modern S3 implementations can enforce immutability directly against stored objects. With S3 Object Lock, protected objects can be retained under a write-once-read-many model. During the specified retention period, ransomware attempting to overwrite, encrypt or delete those objects cannot simply replace the protected backup with its encrypted version. This creates an important separation between compromising a production system and destroying its recovery data. Traditional backup repositories can also be hardened, but object storage provides several characteristics that are particularly useful for ransomware recovery: S3 Object Lock WORM retention No traditional mounted filesystem exposed to clients Independent authentication and authorization Large-scale capacity Policy-driven retention Encryption Erasure coding or replication Compatibility with modern backup applications The important distinction is that object storage alone does not make backups ransomware-proof. Its security depends on how immutability, credentials, administration, networking and retention are implemented. The best object storage platforms for ransomware protection 1. Scality ARTESCA Best for: Cyber-resilient on-premises and hybrid backup storage Scality ARTESCA is purpose-built as object storage for backup and ransomware recovery. Rather than treating immutability as an optional storage feature, its architecture is designed around maintaining a protected recovery copy. ARTESCA uses S3 Object Lock to make backup objects immutable immediately when they are written. Compliance mode can prevent protected objects from being deleted or modified before their retention period expires, including attempts involving highly privileged accounts. Its ransomware protection extends beyond Object Lock through Scality’s CORE5 cyber-resilience architecture, which applies protections across five layers: API Data Storage System Architecture This matters because modern ransomware attacks do not necessarily stop at encrypting files. Attackers may obtain administrator credentials, disable backup processes, attempt to delete repositories or exfiltrate sensitive data before encryption begins. ARTESCA adds controls including identity and access management, encryption, hardened administration, MFA and credential separation to reduce those risks. The platform is also designed around integration with leading backup applications rather than requiring organizations to build their own S3-based backup workflows. ARTESCA can start at relatively modest capacity and scale into multi-petabyte environments, making it particularly relevant for mid-market and enterprise organizations that want to keep immutable backup infrastructure under their own control. Scality also backs qualifying ARTESCA deployments with its $100,000 Cyber Guarantee when applicable requirements are met, including the use of S3 Object Lock in compliance mode. 2. Amazon S3 Best for: Cloud-native ransomware protection Amazon S3 established S3 Object Lock as a widely adopted mechanism for object immutability. Organizations can use Object Lock to prevent objects from being overwritten or deleted during a specified retention period. Compliance mode provides the strongest retention model and is useful for organizations that need strict WORM controls. Amazon S3 also provides a broad security ecosystem encompassing IAM, encryption, logging, monitoring and replication. For organizations already operating primarily in AWS, this can make S3 a natural location for protected backup copies. The tradeoff is primarily architectural and economic. Organizations need to consider ongoing capacity costs, data retrieval, network dependencies and data-transfer charges when designing large recovery environments. Amazon S3 is therefore particularly strong when cloud integration is more important than maintaining direct control of the underlying storage infrastructure. 3. Cloudian HyperStore Best for: Large on-premises S3 environments Cloudian HyperStore is another distributed object storage platform commonly evaluated for backup and ransomware protection. It supports S3 compatibility and Object Lock, allowing backup applications to maintain immutable copies on on-premises infrastructure. HyperStore is particularly relevant to organizations that need significant object capacity across multiple nodes or locations while maintaining an S3 storage architecture within their own data centers. As with any platform in this category, buyers should evaluate the implementation of immutability alongside administrative security, backup application certification and recovery performance rather than comparing platforms solely on S3 compatibility. 4. MinIO Best for: Organizations wanting software-defined S3 storage MinIO provides software-defined S3-compatible object storage that can be deployed across different infrastructure environments. Its Object Lock capabilities can support WORM retention for applications that use compatible S3 APIs. Its software-defined approach can also appeal to organizations standardizing around Kubernetes, private cloud or commodity infrastructure. The operational model deserves careful evaluation for ransomware-sensitive deployments. Organizations should consider who will maintain the platform, how administrative credentials are isolated and how the storage environment will remain protected if surrounding infrastructure is compromised. Flexibility can be valuable, but ransomware recovery infrastructure also needs to remain deliberately difficult to alter. 5. Enterprise backup appliances and data protection platforms Best for: Organizations prioritizing an integrated recovery stack Platforms from vendors such as Dell, Rubrik and Cohesity take a somewhat different approach. Rather than deploying a standalone S3 object store and connecting it to a separate backup application, organizations can adopt infrastructure where backup software, storage and cyber-recovery capabilities are more tightly integrated. This can simplify operations and provide useful recovery orchestration. The tradeoff is that these products should not always be compared directly with general-purpose object storage. Organizations choosing between the two models need to decide whether they want an independent immutable storage layer or a more vertically integrated data protection platform. Comparison of object storage for ransomware protection PlatformBest fitS3/Object Lock approachDeploymentScality ARTESCAImmutable backup and cyber recoveryNative S3 Object Lock plus multi-layer cyber resilienceOn-premises, edge, private/hybrid environmentsAmazon S3Cloud-native backupNative S3 Object LockPublic cloudCloudian HyperStoreLarge S3 backup environmentsS3-compatible Object LockPrimarily on-premises/private cloudMinIOSoftware-defined S3 infrastructureS3-compatible Object LockSoftware-defined/private cloudIntegrated backup platformsEnd-to-end backup and recoveryVendor-specific immutability and isolationAppliance, software or cloud Features alone should not determine the decision. The security boundaries surrounding those features matter just as much. 8 features to look for in ransomware-protected object storage 1. S3 Object Lock S3 Object Lock should be near the top of any ransomware-protection checklist. It allows backup applications to specify how long an object must remain immutable. Because the protection is enforced by the storage system, ransomware cannot simply issue an ordinary delete or overwrite request against a locked backup. For organizations using applications such as Veeam, Commvault or other S3-aware backup platforms, verify the storage system’s exact Object Lock implementation and certification. 2. Compliance-mode immutability Supporting Object Lock is only the beginning. Organizations should understand whether privileged administrators can shorten retention, disable protection or otherwise circumvent the lock. Compliance mode is particularly important for high-value recovery copies because the retention period cannot simply be overridden by an administrator. That reduces the impact of both compromised credentials and malicious insiders. 3. Administrative isolation One of the most important questions during a storage evaluation is: What happens if the attacker obtains the backup administrator’s credentials? If those credentials also provide complete control of the storage system, the supposed secondary copy may share the same security boundary as the compromised environment. Separate credentials, role-based access, MFA and least-privilege administration help prevent one compromised identity from controlling the entire recovery chain. 4. A hardened storage environment The storage platform itself needs protection. Look for features such as: MFA Role-based access control Restricted privileged access Secure management interfaces Encryption at rest TLS for data in transit Audit logging Network segmentation Secure software update mechanisms The goal is to reduce the number of paths an attacker can use to reach protected data. 5. Backup application integration Generic S3 compatibility does not automatically mean a platform is a good backup target. A ransomware-protection deployment should be tested with the backup application actually responsible for creating and recovering the data. Check vendor certifications and supported configurations for platforms such as Veeam, Commvault and other enterprise data protection applications. This reduces the risk of discovering interoperability problems during recovery. 6. Data durability and self-healing Ransomware is only one threat to backup data. Disk failures, server failures, corruption and infrastructure outages still occur. Object storage should therefore provide mechanisms such as erasure coding, replication, integrity checking and automated repair. Cyber resilience does not replace traditional storage resilience. Organizations need both. 7. Restore performance An immutable backup that takes too long to restore can still create a major business problem. Storage evaluations frequently emphasize backup ingest performance because it is easy to benchmark. During a ransomware incident, however, restore throughput becomes the critical metric. Test recovery under realistic conditions: Multiple simultaneous restores Large backup sets Millions of smaller objects Full-site recovery Network constraints Degraded storage conditions The target should be meeting the organization’s recovery time objectives, not winning an isolated throughput benchmark. 8. Independent recovery architecture The strongest backup architectures avoid relying on a single trust domain. Production infrastructure, backup software and immutable storage should not all depend on the same administrator credentials, directory services or management plane. Object storage can provide a useful independent security boundary, particularly when deployed on separate infrastructure with its own authentication and administrative controls. Is immutable storage enough to stop ransomware? No. Immutability addresses one extremely important problem: preventing protected data from being changed or deleted. But ransomware operations can involve more than encryption. Attackers may steal data, compromise identities, disable infrastructure, attack hypervisors, destroy configurations or wait inside an environment until backup retention windows expire. That is why cyber resilience should extend beyond immutable storage. A strong ransomware recovery architecture combines immutable backups with: Identity isolation MFA Least-privilege administration Network segmentation Encryption Multiple recovery copies Monitoring Retention controls Recovery testing Incident response procedures Immutability protects the copy. Cyber resilience protects the recovery path. Object storage vs. traditional backup storage for ransomware Traditional disk repositories can provide excellent backup performance, but their security characteristics depend heavily on how the repository is exposed and administered. A filesystem accessible through common protocols may present a different attack surface than an object repository accessible through authenticated S3 APIs. Object storage also makes WORM-style retention easier to integrate directly into modern backup workflows through Object Lock. That does not mean every organization should replace all backup storage with object storage. A layered architecture may use fast primary backup storage for operational recovery while maintaining an immutable object copy for ransomware recovery. The objective is not to standardize on one media type. It is to make sure compromising one recovery tier does not compromise every recovery tier. On-premises vs. cloud object storage for ransomware protection Both models can provide effective immutable storage. Cloud object storage removes responsibility for operating the underlying storage hardware and can create useful geographic and administrative separation from the primary environment. However, organizations should model recurring storage charges, retrieval costs, bandwidth requirements and the time required to recover large datasets across a WAN connection. On-premises object storage gives organizations greater control over infrastructure, network architecture, performance and data location. It can also provide predictable economics for very large backup datasets. The strongest design may combine both approaches depending on recovery requirements. For example, an organization could maintain an immutable on-premises object repository for rapid ransomware recovery while retaining another geographically separated copy for disaster recovery. Which object storage is best for Veeam ransomware protection? For Veeam environments, the shortlist should focus on storage specifically validated for Veeam’s object-storage workflows rather than generic S3 implementations. S3 Object Lock allows Veeam to write backups directly to object storage while applying immutability according to the configured retention model. Scality ARTESCA is particularly relevant here because backup is its primary workload. ARTESCA integrates with Veeam while combining S3 Object Lock with Scality’s broader CORE5 cyber-resilience architecture. Organizations should still validate the entire recovery workflow, including retention configuration, credential separation, capacity planning and restore performance. Which object storage is best for mid-market ransomware protection? Mid-market organizations often have a different problem than very large enterprises. They need strong immutability without adding another complex infrastructure platform requiring a large specialist storage team. For this environment, look for storage that can: Start at relatively modest capacity Scale without disruptive migrations Integrate directly with existing backup software Enforce immutability without extensive manual configuration Operate on standard infrastructure Minimize administrative overhead This is the use case ARTESCA is designed to address. It provides the S3 and cyber-resilience capabilities associated with enterprise object storage while starting at capacities suitable for smaller backup environments. Which object storage is best for large enterprises? Very large organizations may have different requirements, including tens of petabytes of data, multiple sites, geographically distributed applications and workloads extending well beyond backup. In those cases, a broader scale-out platform such as Scality RING may be more appropriate. RING provides large-scale file and object storage with S3 Object Lock and cyber-resilience capabilities while supporting environments extending from petabytes toward exabyte scale. The distinction is important: ARTESCA is optimized around backup storage, while RING addresses broader enterprise data infrastructure requirements. The best product depends on the workload rather than simply the size of the company. How should you evaluate object storage for ransomware protection? Start the evaluation from the assumption that attackers have already compromised something important. Then ask: Can they delete the backup? If Object Lock in compliance mode is correctly configured, the answer should be no during the retention period. Can they use compromised backup credentials to administer the storage? Ideally, no. Those trust domains should be separated. Can they encrypt the backup through the application? Locked objects should remain protected against modification. Can they compromise the storage operating environment? Administrative hardening, MFA, least privilege and architectural controls should make this substantially more difficult. Can we actually recover the environment fast enough? That must be demonstrated through testing. These questions expose meaningful differences between platforms much more effectively than comparing feature checklists. So, what is the best object storage for ransomware protection? There is no single object storage product that fits every ransomware-protection architecture. Amazon S3 is compelling for organizations that want cloud-native immutable storage. Large-scale S3 platforms such as Cloudian can address private-cloud and enterprise object storage requirements. Integrated data protection platforms can make sense when organizations prefer to obtain backup software, storage and recovery capabilities from a single vendor. For organizations specifically looking for on-premises or hybrid object storage designed around immutable backup and ransomware recovery, Scality ARTESCA should be high on the shortlist. Its combination of S3 Object Lock, compliance-mode immutability, backup application integration and CORE5 cyber resilience addresses the broader problem: keeping the recovery copy intact even after attackers have breached other parts of the environment. Ultimately, the best object storage for ransomware protection is the one that can answer the most important question after an attack: Is there still a clean, immutable copy of the data, and can we restore it fast enough to recover the business? Frequently asked questions What is ransomware-protected object storage? Ransomware-protected object storage combines object-based data storage with controls designed to prevent attackers from modifying or deleting protected data. Common capabilities include S3 Object Lock, WORM retention, encryption, identity controls, MFA and administrative isolation. Does S3 Object Lock prevent ransomware? S3 Object Lock can prevent ransomware from modifying or deleting locked objects during their retention period. It does not prevent the initial cyberattack, data theft or compromise of other systems, so it should be one component of a broader cyber-resilience strategy. What is immutable object storage? Immutable object storage prevents stored objects from being changed or deleted for a specified period. With S3 Object Lock in compliance mode, the retention restriction is enforced by the storage system and cannot simply be shortened by an administrator. Is object storage good for ransomware backups? Yes. Object storage is well suited to ransomware-resistant backup because it can combine large-scale capacity with S3 Object Lock, WORM retention and independent security controls. Major backup applications increasingly support S3-compatible storage as an immutable backup target. Should ransomware backups be on-premises or in the cloud? Either can work. On-premises object storage provides local control and potentially faster large-scale recovery, while cloud object storage provides infrastructure and geographic separation. Some organizations use both as separate recovery tiers. What is the difference between immutable backup and cyber-resilient storage? Immutable backup focuses primarily on preventing protected data from being modified or deleted. Cyber-resilient storage extends protection to other attack paths, including compromised credentials, administrative access, data exfiltration, infrastructure attacks and recovery operations.
