Ransomware continues to evolve, and MSPs are now expected to protect clients not only with backups, but with disaster recovery-ready architectures that remain resilient even if attackers compromise the backup control plane.
Backup software alone does not determine recoverability.
Architecture does.
This guide outlines three modern models MSPs can confidently deploy – from minimum viable protection to multi-copy resilience – along with the isolation boundaries that prevent backup corruption and enable reliable disaster recovery.
These models modernize the familiar enhanced 3-2-1-1-0 rule and reflect real-world lessons from ransomware incidents.
Why MSPs Need to Modernize Backup Architecture
Attackers no longer stop at encrypting production systems.
They now target:
- the Veeam control plane
- Windows/NAS repositories
- direct-to-object storage paths
- backup API delete operations
- service accounts and credentials
- backup copies synchronized across platforms
This aligns with trends highlighted in NIST’s general ransomware guidance for small and midsized organizations.
When backups are compromised, MSPs lose their most important recovery asset.
This is why architecture – not tool selection – determines whether DR succeeds.
Direct-to-Object Is Common, But Not Sufficient
Many MSPs adopted direct-to-object backups after Veeam v11 introduced the feature. While simple and inexpensive, this model has a critical weakness:
it depends entirely on the Veeam server’s security posture.
If attackers compromise the server, they can attempt to corrupt or delete object-storage backups as well.
This model is an improvement over having no offsite copy, but MSPs should treat it as the baseline, not the destination.
MODEL 1 – Direct-to-Object Backup (2-1-1-1-0)
Minimum protection – vulnerable to control-plane compromise
How this model functions
- Production → Veeam Server → Object Storage
- One offsite copy
- No hardened local repository
- No isolation boundary
Primary risks
- The Veeam server becomes a single point of failure
- Attackers can potentially issue deletion commands to object storage
- Offsite copies may remain intact but inaccessible for weeks during lockouts
- Recovery times can exceed client tolerance
This is still widely deployed, but it is not ransomware resilient.
Cloud Connect: The First True Protection Boundary
The biggest architectural improvement MSPs can make is introducing a Cloud Connect isolation layer.
Veeam’s documentation outlining Cloud Connect architecture
Cloud Connect stops the attack path before object storage is exposed.
Why this boundary matters for MSPs
Cloud Connect prevents attackers from issuing deletion or corruption commands directly to object storage.
Even if the Veeam server is compromised, the Cloud Connect provider’s hardened infrastructure protects offsite backup copies.
This isolation layer sets the foundation for the modernized 3-2-1-1-0 model.
MODEL 2 – Baseline Safe Model (3-2-1-1-0)
The modern minimum for ransomware-resilient backup architecture
This configuration moves MSPs from “backup exists” to “backup survives an attack.”
Why this model works
1. Hardened Repository = protected local copy
Windows/NAS backup targets fall immediately during ransomware events.
A Linux Hardened Repository provides immutability and resilience against tampering, as outlined in Veeam’s documentation:
https://helpcenter.veeam.com/docs/backup/vsphere/hardened_repository.html.
2. Cloud Connect = isolation
Attackers may reach the Veeam server, but they cannot cross the Cloud Connect boundary.
3. Object Storage = tertiary copy
Provides offsite retention and immutability without exposing storage directly to the Veeam server.
For MSPs, this is the recommended minimum protection level for general SMB clients.
MODEL 3 — Standard Cloud IBR Model (4-3-2-1-0)
Higher resilience + offsite immutability + disaster recovery readiness
This model expands redundancy without complicating operations.
It is a strong fit for MSPs serving mid-market, compliance-driven, or multi-site clients.
Why MSPs deploy this model
- Additional resilience for ransomware
- Reliable offsite immutability
- Supports Cloud IBR’s automated DR recovery workflows
- Reduces the need for maintaining pre-staged DR infrastructure
- Provides predictable RPO/RTO across client environments
This architecture is widely adopted by MSPs upgrading from older 3-2-1-style environments.
MODEL 4 – Premium Multi-Copy Architecture (5-4-3-1-0)
Maximum ransomware durability for high-risk or compliance-bound organizations
This model adds a second, independent object storage provider.
It significantly increases the likelihood of retaining a clean, accessible copy during a cyber event.
Who chooses this model
- Organizations that previously experienced ransomware
- Regulated industries (finance, healthcare, legal)
- Businesses with high hourly downtime costs
- MSPs delivering premium DR tiers
The addition of a second object storage provider ensures offsite diversity and reduces dependency on any single vendor or region.
Backup Architecture Progression — MSP Reference Overview
How MSPs Should Present These Models to Clients
1. Focus on recoverability, not backup software
Clients assume backups exist.
What they care about is whether recovery is possible — and how quickly.
2. Use architecture tiers
Tiering helps clients self-select based on:
- Downtime tolerance
- Budget
- Compliance
- Business impact
3. Explain ransomware strategy simply
Attackers go after backups first because it increases leverage.
Your architecture stops that.
4. Position Cloud IBR as the DR execution layer
Cloud IBR does not replace Veeam.
It automates disaster recovery:
- Builds Bare Metal Cloud infrastructure
- Restores workloads
- Handles networking & failover
- Performs DR testing
- Manages failback
Backups become recoverable, not just present.
Final Takeaway for MSPs
Backup tools are essential – but without the right architecture, even the best tools cannot guarantee recovery.
MSPs who modernize to 3-2-1-1-0 and multi-copy models deliver:
- Fast, reliable disaster recovery
- Ransomware-resilient backup chains
- Lower operational risk
- Stronger client trust
- A differentiated DR-ready service offering
Resilience doesn’t come from adding more backup paths – it comes from being able to execute recovery when it matters.
And ultimately:
Ransomware becomes an IT incident – not a business-ending event.