Immutable backups are backup copies that cannot be changed or deleted once they are written, until a set date, even by someone who holds the administrator's password. Immutable means unchangeable. An immutable backup is the main way that companies protect their backups from ransomware.
Why is a password not enough? Attackers who break into a company often steal an administrator's password first. An administrator is a user who is allowed to change any setting. With that password, an attacker can log in to the backup software and delete every backup. Only then do they encrypt the live data. The company is left with no copy to restore, and is under pressure to pay. This has become a standard step in ransomware attacks.
How does it work? When a backup is written, the storage gives it a lock with an end date, called a retention lock. Until that date, the storage refuses every request to change or delete the copy, whoever sends the request. The lock is enforced by the storage itself, not by a setting that a user can switch off. In the strictest mode, often called compliance mode, nobody can remove the lock early, not even the storage maker. Cloud object storage offers the same protection, often under the name object lock.
Say a small finance bank in Jaipur locks each night's backup for 30 days. One night, an attacker logs in to the backup console with a stolen administrator password. The attacker tries to delete the last 30 days of backups. The storage refuses each request, because every copy is still locked. The attacker then tries to shorten the lock to zero days. The storage refuses that too. Each refused request raises an alert, and the bank's security team is woken at 3:10 a.m. Later that night, the attacker encrypts the bank's file servers. The bank restores them from the previous night's copy, which is still intact.
Immutability has a cost. A locked copy cannot be deleted even when the company wants it deleted, for example to free space, or to remove a customer's data when a data protection law requires it. So the lock period must be chosen with care. Many companies lock their daily backups for 14 to 30 days, and their monthly backups for longer.
An immutable backup protects the copy from being changed. It does not hide the copy. An attacker inside the network can still see it, and can try to attack the storage system itself. An air-gapped backup adds the second protection: it keeps the copy out of the attacker's reach altogether. Most companies use both. Both are features of backup and recovery software, and both make ransomware recovery possible. Refusing a request even from an administrator follows the idea of zero trust.