96% of ransomware attacks target backups.
Not servers.

This isn't a metaphor. 96% of ransomware attacks target the backup environment first - because attackers know exactly what every administrator knows: whoever has a current copy has a way out. So the goal is simple: take away the way out before encrypting everything else.

The organization we carried out this project for is one of the largest IT institutions in the Polish public sector. Billions of zloty flow through its systems every month. Thousands of users, hundreds of servers, over a petabyte of data. An hour of downtime isn't an operating cost - it's a direct consequence for millions of people.

For years, the answer to the security question was: we have backup. And that was true. The problem is that hackers can lurk inside a victim's network for an average of 9 months before striking. For 9 months, they study the infrastructure, map the backup systems, and wait. When they finally act, they hit everything at once, backups included.

Traditional backup doesn't protect against this scenario, because it copies the data - and copies the infection that's been sitting in it for months. The question shifted from "do we have backup" to "will our backup survive an attack". And no one could answer that with fact-based certainty.

Principle of operation: the isolated data storage environment opens from the inside - through a one-way channel, for 15-40 minutes during the synchronization window. After that, it physically or logically disappears from the network. There's no address it can be reached at from outside. An infection in production systems has no physical path to the Bunker.

Before the Bunker was deployed, the organization had backup and had a declaration of security. Today it has something different: a documented, measured, and repeatable recovery time for every critical system. Measured - because it's tested. Repeatable - because it's carried out regularly. Auditable - because every test session generates full documentation.

An unplanned side effect was a radical simplification of the backup management architecture. A dozen-plus scattered backup tools were replaced by a single, logically designed system with centralized monitoring and automatic reporting. Fewer places where something can go wrong. Fewer decisions made manually under time pressure.

NIS2 has taken effect. DORA has defined new requirements for the financial sector. In Poland, according to CERT Polska data, the number of cybersecurity incidents in the public sector is rising year over year. The question is no longer "do we have procedures". It's "have those procedures ever been tested under real attack conditions"?

This project is one of the largest cyber recovery deployments in the Polish public sector. It shows that ransomware resilience can be designed from the ground up, built at this scale, and documented in a way that satisfies the board, auditors, and regulators alike. That "impossible" often just means "haven't done it yet".

For Engave, this confirms a thesis we've believed in for years: data security is measured by repeatable test results - not declarations, not certificates, not the number of tools deployed. Everything else is just talk.