Snapshots Are Not Backups: Why Veeam and Tape Still Rule

The Misconception: Snapshots Are Backups

We hear it all the time: "We're covered because we have snapshots." It's wrong, dangerously wrong. Snapshots are point-in-time copies that often use pointers rather than full physical copies, allowing them to be created quickly with low initial disk usage. But as NIST SP 800-209 warns, if the source data is unavailable, the snapshots will often not be usable either. And VMware is blunt about it: a snapshot is not a backup; it's only a change log of the original virtual disk. If the base disks are deleted, the snapshot files alone are not sufficient to restore a virtual machine. So when ransomware hits, that snapshot you're relying on may be just as corrupted as the original.

The 3-2-1-1-0 Rule and What It Means for Software Choice

Let's start with the standard. The 3-2-1 rule, coined by photographer Peter Krogh, calls for 3 copies of data, on 2 different storage media, with 1 copy off-site. CISA endorses this, and now pushes a modernized 3-2-1-1-0 rule that adds 1 immutable or air-gapped copy and 0 unverified backups. That last '0' is the kicker: an untested backup is an assumption, not a backup. So when we evaluate backup software, we're not just looking at features; we're looking at whether the tool can support an immutable copy and whether it makes testing practical.

The Contenders: Veeam, AWS Backup, and Tape

In our world, three options dominate the conversation: Veeam, AWS Backup, and good old tape (via LTO). Veeam is the practitioner's choice for on-prem and hybrid environments, especially where VMware is the hypervisor. AWS Backup is the cloud-native default if you're all-in on AWS. And tape, specifically LTO-9, is the air-gapped hero that never gets breached because it's offline. Let's compare them on four concrete criteria: immutability, recovery speed, long-term cost, and ransomware resilience.

Veeam: The Workhorse for On-Prem and Hybrid

If you're running VMware, Veeam is the tool we've seen rescue more operations than any other. It integrates with VMware snapshots, but it doesn't rely on them as backups; it uses them to create consistent application-aware backups. It supports the 3-2-1-1-0 rule out of the box with features like hardened repositories that use object lock to make backups immutable. That's critical because NIST SP 800-209 defines immutability as the ability to lock data after creation, preventing alteration or deletion. For most small and mid-sized shops, Veeam is the recommendation. It gives you fast recovery (RTO in minutes, not hours) and lets you set RPOs as low as minutes. But it's not perfect: it's not a cloud-native solution, and if you're all-in on AWS, you're paying for storage on primary disk, which can be pricier than S3.

AWS Backup: The Cloud-Native Option

For those living in AWS, AWS Backup is the obvious choice. It's fully managed, policy-based, and integrates natively with S3. You define backup policies, and it automates the creation of backups, storing them in an encrypted backup vault. It supports continuous backups for point-in-time restore within the last 35 days, and periodic backups for long-term retention up to 99 years. That's powerful, but it requires care: S3 Versioning must be activated before AWS Backup can back up a bucket, and without a lifecycle expiration rule, storage costs might increase because AWS Backup retains all versions. We've seen bills balloon because someone skipped the lifecycle rule. And while AWS Backup is great for cloud, it doesn't help with on-prem workloads unless you add the AWS Storage Gateway. So it's not a universal solution.

Tape: The Air-Gapped Insurance Policy

Now for the controversial choice: tape. Many practitioners dismiss it as obsolete, but LTO-9 offers 18 TB native capacity per cartridge, with a user bit error rate of 10^20, meaning about 12.5 zettabytes of read data between unrecoverable errors. That's reliability you don't get from disk. And the LTO Program emphasizes that tape provides an inherent air gap, giving organizations confidence they can recover data after an attack. Disk storage offers faster recovery, but it's not offline and not completely secured from ransomware. In a ransomware scenario, tape is your last line of defense. The downside is RTO: tape is slow. If your RTO is under an hour, tape alone won't cut it. But for long-term archival and compliance, tape is unbeatable in cost per GB. The LTO roadmap shows capacities doubling each generation, with LTO-14 targeting 1.44 PB per tape, so it's not going away.

Which Wins? It Depends on Your RPO and RTO

Here's the thing: there's no single winner. It depends on your Recovery Point Objective (RPO) and Recovery Time Objective (RTO). NIST defines RPO as the maximum acceptable data loss in time, and RTO as the maximum acceptable downtime. For mission-critical systems, you might need an RTO under 1 hour and an RPO under 5 minutes. That's Veeam with continuous replication. For less critical data, you can afford longer recovery times, so tape might be fine. But if you're hit by ransomware, the FBI's 2024 IC3 report shows losses are rising, with ransomware complaints up 9% from 2023. You need a strategy that includes an immutable or air-gapped copy. That's where the 3-2-1-1-0 rule comes in. We recommend a layered approach: Veeam for fast, immutable backups to disk, AWS Backup if you're in the cloud, and tape for long-term archival and offline protection. And above all, test your backups monthly, as NIST SP 800-209 recommends. If you don't test, you don't have a backup.

Bottom line

Stop relying on snapshots alone. Implement the 3-2-1-1-0 rule with tools that support immutability and air gaps. For most on-prem and hybrid environments, Veeam is the best choice. For cloud-native, AWS Backup is solid if you manage lifecycle. And never underestimate tape as your offline insurance. The single best move is to combine Veeam for operational recovery, AWS Backup for cloud workloads, and tape for offline archival — then test monthly. That's how you survive ransomware.

Sources

• CISA - https://www.cisa.gov/stopransomware
• NIST SP 800-209 - https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-209.pdf
• NIST SP 800-34 Rev. 1 - https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-34r1.pdf
• Broadcom KB - https://knowledge.broadcom.com/external/article/318825/best-practices-for-using-vmware-snapshot.html
• AWS Backup - https://docs.aws.amazon.com/aws-backup/latest/devguide/s3-backups.html
• LTO Program - https://www.lto.org/newsbytes-september-2022/