Skip to main content
StickyVeeam Oxford Style Debate #1

Veeam Oxford Style Debate - Episode 1

Show first post

58 comments

Geoff Burke
Forum|alt.badge.img+22
  • Veeam Vanguard
  • May 22, 2026

I did videos for that course but was not involved in the actual production of the course material so can’t really comment. I can only do so much 🤣and with all of this travelling I need time for my beauty sleep 😂, ok well sleep 🤐


Iams3le
Forum|alt.badge.img+13
  • May 22, 2026

Hi ​@Madi.Cristil, before Geoff jumps in, I would argue that this exact certification question and explanation actually support the 'FOR' argument perfectly.

Look at the core requirement: 'Resilience requires architecture, immutability, and validation together.' Let’s run a simple thought experiment and take immutability entirely out of the picture.

Imagine an organization has every single defense-in-depth control active, but a breach still happens and their traditional backups are wiped out. What should they do next? ... negotiate, and pay the ransom probably!

The answer for most businesses! That is exactly why immutability is the foundational pillar of the entire recovery strategy. It is the one control that completely changes the outcome of a breach when everything else fails.

… I see where the the disagrement is coming from. The word only as ​pointed out in the recap. 

To wrap up my thoughts on this thread, I am glad we all agree that cyber resilience is not an 'either/or' proposition. It demands a robust, layered security strategy. No argument there.

But we must explicitly acknowledge the foundational role of immutability. While tools like MFA, segmentation, and EDR work tirelessly to prevent and detect attacks, immutability has one distinct, non-negotiable job: guaranteeing backup integrity when those front-line controls fail.


Geoff Burke
Forum|alt.badge.img+22
  • Veeam Vanguard
  • May 22, 2026

I think we should all get big pay raises because we are all so smart, who disagrees? 😄


Andanet
Forum|alt.badge.img+12
  • Veeam Legend
  • May 22, 2026

I think we should all get big pay raises because we are all so smart, who disagrees? 😄

Thant’s me! 😎


Madi.Cristil
Forum|alt.badge.img+8
  • Author
  • Principal Community Manager
  • May 22, 2026

Hi ​@Madi.Cristil, before Geoff jumps in, I would argue that this exact certification question and explanation actually support the 'FOR' argument perfectly.

Look at the core requirement: 'Resilience requires architecture, immutability, and validation together.' Let’s run a simple thought experiment and take immutability entirely out of the picture.

Imagine an organization has every single defense-in-depth control active, but a breach still happens and their traditional backups are wiped out. What should they do next? ... negotiate, and pay the ransom probably!

The answer for most businesses! That is exactly why immutability is the foundational pillar of the entire recovery strategy. It is the one control that completely changes the outcome of a breach when everything else fails.

… I see where the the disagrement is coming from. The word only as ​pointed out in the recap. 

To wrap up my thoughts on this thread, I am glad we all agree that cyber resilience is not an 'either/or' proposition. It demands a robust, layered security strategy. No argument there.

But we must explicitly acknowledge the foundational role of immutability. While tools like MFA, segmentation, and EDR work tirelessly to prevent and detect attacks, immutability has one distinct, non-negotiable job: guaranteeing backup integrity when those front-line controls fail.

@Iams3le really love how you keep bringing arguments ! 😉


Madi.Cristil
Forum|alt.badge.img+8
  • Author
  • Principal Community Manager
  • May 22, 2026

I did videos for that course but was not involved in the actual production of the course material so can’t really comment. I can only do so much 🤣and with all of this travelling I need time for my beauty sleep 😂, ok well sleep 🤐

Ah yes, I forgot about your beauty sleep 😂


Scott
Forum|alt.badge.img+10
  • Veeam Legend
  • May 23, 2026

Lol, ​@Stabz  went for two sides of the coin. BTW, we all are saying the same thing ​@dips and ​@Stabz with a little distinction on the game changer/showstopper for threat actors (bad guys) in modern ransomware scenarios. 

We can have strong defense-in-depth controls in place, but without immutable backups the critical question remains: what happens when a breach actually succeeds?

Modern ransomware campaigns are designed not only to disrupt production systems but also to target recovery capabilities. Even with layered security such as MFA, EDR, network segmentation, and Zero Trust principles, attackers can still gain access through phishing, credential compromise, or long dwell-time intrusions. Once inside, their objective often shifts toward locating and destroying backup infrastructure.

If backups are not immutable, a successful attacker can delete or encrypt backup data, compromise backup credentials, disable protection jobs, or manipulate retention settings. In such a scenario, both production and backup environments may become unrecoverable, effectively eliminating the organization’s ability to restore services without external negotiation. Isn’t this one of the reasons we have Coveware by Veeam?

@Madi.Cristil, I have a question regarding the debate structure and learning outcome from this discussion. Will there be subject matter experts or judges who will review and analyze the arguments presented by participants, similar to the weekly recap sessions where responses are dissected for educational purposes and broader community learning?

I believe this would add significant value to the debate, especially given the depth of perspectives shared around immutability, defense-in-depth, ransomware resilience, and cyber recovery strategies which we all have agreed must work together. Having expert analysis on the strengths, weaknesses, and technical accuracy of the arguments presented would greatly enhance the learning experience for everyone involved.

By the way, here is an industry report published today that further contributes to the discussion: https://objectfirst.com/newsroom/press-releases/object-first-surges-in-q1-2026-as-immutability-becomes-a-security-requirement-for-backup/

You just added a new layer to it, Chris ! I am gonna get that idea and be creative with it ;) 

 

I’m interested in judging if you need people. or participating. 

This was fun, I can’t wait for more of them, but maybe not something that is more opinion than fact as we all know Immutability is important, but only part of the solution.

 

Here are a few off the top of my head that might work.

Immutability vs air gap.

Snapshots vs Backups for an application upgrade.  

Fiber Channel VS iSCSI 

Object Vs Block Storage for repository

Linux vs Windows Veeam servers and repositories.

Is NVME worth the price for your backup storage?

Better to back up more frequently, or retain for longer periods?

Replication vs Backups for DR

 

I feel those topics I could argue points for either side. 


Madi.Cristil
Forum|alt.badge.img+8
  • Author
  • Principal Community Manager
  • May 24, 2026

Lol, ​@Stabz  went for two sides of the coin. BTW, we all are saying the same thing ​@dips and ​@Stabz with a little distinction on the game changer/showstopper for threat actors (bad guys) in modern ransomware scenarios. 

We can have strong defense-in-depth controls in place, but without immutable backups the critical question remains: what happens when a breach actually succeeds?

Modern ransomware campaigns are designed not only to disrupt production systems but also to target recovery capabilities. Even with layered security such as MFA, EDR, network segmentation, and Zero Trust principles, attackers can still gain access through phishing, credential compromise, or long dwell-time intrusions. Once inside, their objective often shifts toward locating and destroying backup infrastructure.

If backups are not immutable, a successful attacker can delete or encrypt backup data, compromise backup credentials, disable protection jobs, or manipulate retention settings. In such a scenario, both production and backup environments may become unrecoverable, effectively eliminating the organization’s ability to restore services without external negotiation. Isn’t this one of the reasons we have Coveware by Veeam?

@Madi.Cristil, I have a question regarding the debate structure and learning outcome from this discussion. Will there be subject matter experts or judges who will review and analyze the arguments presented by participants, similar to the weekly recap sessions where responses are dissected for educational purposes and broader community learning?

I believe this would add significant value to the debate, especially given the depth of perspectives shared around immutability, defense-in-depth, ransomware resilience, and cyber recovery strategies which we all have agreed must work together. Having expert analysis on the strengths, weaknesses, and technical accuracy of the arguments presented would greatly enhance the learning experience for everyone involved.

By the way, here is an industry report published today that further contributes to the discussion: https://objectfirst.com/newsroom/press-releases/object-first-surges-in-q1-2026-as-immutability-becomes-a-security-requirement-for-backup/

You just added a new layer to it, Chris ! I am gonna get that idea and be creative with it ;) 

 

I’m interested in judging if you need people. or participating. 

This was fun, I can’t wait for more of them, but maybe not something that is more opinion than fact as we all know Immutability is important, but only part of the solution.

 

Here are a few off the top of my head that might work.

Immutability vs air gap.

Snapshots vs Backups for an application upgrade.  

Fiber Channel VS iSCSI 

Object Vs Block Storage for repository

Linux vs Windows Veeam servers and repositories.

Is NVME worth the price for your backup storage?

Better to back up more frequently, or retain for longer periods?

Replication vs Backups for DR

 

I feel those topics I could argue points for either side. 

Hey ​@Scott ! I agree, we have to find more debatable topics 😉Have a nice Sunday!