BDRaaS Briefing: Selling the Restore, Not the Backup
Most of what shipped this week was about the restore rather than the backup. Cohesity made clean room recovery generally available in FortKnox, Slide started previewing Microsoft 365 backup with its MSP partners, and a Lyon startup called Cybee has built a European backup service whose whole pitch is how fast it gets data back.
On the service side, Keepit has signed ICOS as its only distributor in Italy, and Nexcess has put a managed DR tier on top of Acronis. The security story that matters is a Veeam Agent for Windows flaw with a public exploit. Whether anyone is using it yet depends on who you ask.
Vendor releases
Cohesity makes clean room recovery generally available in FortKnox
Cohesity says clean room recovery is now generally available for both FortKnox SaaS and self-managed deployments. It recovers vaulted snapshots, plus what Cohesity calls Digital Jump Bag assets, into an isolated environment so they can be investigated and validated before anything goes back to production. Self-managed customers also get physical air-gap management controls, flexible vault retention periods and simpler cluster pairing.
The announcement does not say which clouds or regions the clean room runs in, and gives no pricing.
The practical bit. A lot of ransomware runbooks go straight from “restore” to “production” with nothing in between, which is how people reinfect themselves from their own backups. If you resell FortKnox, ask where the clean room physically runs before you quote it to a client with a residency clause. Nobody has said yet.
Source: Cohesity
Slide previews Microsoft 365 backup
Slide is adding Microsoft 365 to its backup platform, managed from the same interface as its BCDR appliances rather than as a separate product. It went to MSP partners as a preview this week, with a broader release planned for early next year. No pricing yet.
Separately, ChannelPro reports that Slide has gone from about a dozen preview partners to more than 1,000 in roughly 15 months, from one data centre to four, and that it now operates in Canada and Europe.
The practical bit. Microsoft 365 is usually the second backup contract a client signs, with a different vendor and a different console. If you already run Slide boxes, the preview is worth joining just to see whether collapsing the two is real. Ask where European Microsoft 365 data will be stored before you move a single tenant.
Sources: ChannelE2E, ChannelPro
Microsoft fixes Windows File History after the September updates broke it
The September 2026 security updates stopped File History backups working on Windows 10 21H2 and later, Windows 10 Enterprise LTSC 2016 and 2019, and Windows 11 23H2 and later. Users saw “Reconnect your drive” with the drive connected. The fix is in optional updates KB5124006 for Windows 11 26H1 and KB5124010 for 24H2 and 25H2, and in the October Patch Tuesday release on 13 October for everything else.
The practical bit. File History is nobody’s backup strategy, but it is often somebody’s. Small clients and home workers lean on it without telling you, and since the September updates it has been failing quietly. Worth a line to anyone whose laptop fleet you do not fully manage.
Source: BleepingComputer
As a service
Keepit signs ICOS as its only distributor in Italy
ICOS becomes Keepit’s distributor for Italy, described as the first and only one in the country. It takes on the reseller, systems integrator and MSP relationships, with pre-sales, certification, joint lead generation and support for partners building managed services. The deal covers the whole Keepit portfolio, including its AI Truth Cloud and AI Safe Room products. The announcement does not say where Italian customers’ data will be hosted.
The practical bit. A single named distributor usually means a proper partner programme is coming to that market, with margin and support to match. If you sell into Italy, that is the route in. If you sell elsewhere, it is a sign Keepit is building country by country rather than relying on direct sales, which is good news for anyone who wants a European SaaS backup brand to resell.
Source: StorageNewsletter
Cybee builds a European backup service on Restic
Cybee is a Lyon company, incorporated in December 2022, that has built a backup service on the open-source Restic engine, with the performance-critical parts rewritten in Rust. Data sits in the Netherlands region of T Cloud Public, Deutsche Telekom’s OpenStack platform. Pricing is 5 euros per VM per month. It sells through MSPs, with Orange Business on the roadmap for the first half of 2027 and other European MSPs from the second half.
The company claims restores of up to 4TB per hour per disk on its fastest SSD tier. Its own website says up to 3TB per hour. Those are Cybee’s numbers, not measured ones.
The practical bit. A European-hosted service at a flat per-VM price, built on an engine you can inspect, is a reasonable thing to put in front of a client who has started asking where their backups live. Ask for a restore test on your own data before you believe either throughput figure.
Source: iTWire
Nexcess adds managed DR, built on Acronis
Nexcess, a managed cloud host, launched managed disaster recovery on 14 September. It keeps live, bootable copies of servers in the cloud, built on Acronis technology, with a stated recovery time objective of one hour. No recovery point objective, pricing or regions were given.
The practical bit. Hosting providers bundling DR on a white-labelled engine is competition for the MSP DR line, and clients will compare your price against it. The comparison to make is the RPO, which Nexcess has not published. An hour’s RTO means little if the copy you boot is a day old.
Source: StorageNewsletter
What is being exploited
Veeam Agent for Windows has a public exploit, and a disputed exploitation report
CVE-2026-32996 is a local privilege escalation in Veeam Agent for Microsoft Windows, rated CVSS 7.3. The flaw is in how the Veeam Endpoint Backup service handles elevated sessions over a local named pipe, and it lets a standard user reach SYSTEM. Proof-of-concept code was published on 14 September.
Arctic Wolf warned of active exploitation. IT-Connect reports that Arctic Wolf later removed that bulletin, and that Veeam’s own bulletin reports no confirmed attacks. It also notes the attack needs an administrator to have opened the agent in elevated mode with a session still active, and cannot give an attacker initial access.
Build 13.0.3.1220 of the agent is fixed. Upgrading Veeam Backup & Replication to 13.0.2.29 or later pushes that build to managed agents. Standalone agents have to be updated on their own; the current standalone release is 13.1.1.700.
The practical bit. Exploited or not, a public exploit for a backup agent on every managed Windows endpoint is the kind of thing that becomes a step in someone else’s intrusion. The managed agents are the easy part. The standalone installs, on the odd laptop or server that never joined VBR, are the ones nobody updates.
Sources: IT-Connect, The Hacker News
A new ransomware group threatens to destroy backups
n0n was first seen on 18 September and had published more than a dozen victims on its leak site by 22 September, mostly in the US, with financial services 23% of confirmed victims. Its extortion notes threaten to encrypt or destroy backups and shadow copies. That is a threat made to the victim, reported by CyberXTron, rather than an observed technique.
The practical bit. The threat only works on a client who cannot answer it. The answer is a copy the attacker’s credentials cannot reach and a restore you have tested recently, and the time to show a client both is before they get that note, not during the call.
Source: Infosecurity Magazine
Regulation and compliance
One in five UK businesses says it chose not to report a serious incident
Databarracks’ Data Health Check 2026 surveyed 500 UK IT decision-makers. 20% said they had chosen not to report a serious cyber incident to avoid the fallout. Under UK GDPR and the Data Protection Act 2018, a personal data breach likely to put people at risk has to go to the ICO within 72 hours, and FCA-regulated firms have separate obligations on top.
The same survey found 59% of those hit by ransomware in the last year recovered from backups without paying, against 18% who paid. Only 43% of organisations describing themselves as very confident in their ransomware response had tested recovery from a cyber attack in the last 12 months. These are Databarracks’ figures from its own survey.
The practical bit. When a client decides not to report, the provider holding their backups and logs is usually the one who knows. Check what your contracts say about who notifies whom, and make sure your incident runbook records the 72-hour clock starting, whoever ends up making the call.
Source: Technology Reseller
Also worth knowing
- CBTS has bought Recovery Point Systems, a US DRaaS provider with its own Tier III data centres and a ransomware recovery service. Announced on 10 September; terms not disclosed. US-only, but a DR specialist being absorbed into a general infrastructure provider is a pattern worth recognising. (StorageNewsletter)
- The Irish Data Protection Commission fined Google Ireland EUR 403m over location data processing, including retention, and gave it six months to comply. (EDPB)
- CISA added CVE-2026-7273 in Zyxel GS1900 switches to the KEV catalog. It has been exploited since 17 August, and The Hacker News reports 996 switches in 48 countries targeted. If one sits in a client’s backup network, patch it. (The Hacker News)
What to do this week
- Find every Veeam Agent for Windows below build 13.0.3.1220. Upgrade VBR to 13.0.2.29 for managed agents, then chase the standalone installs by hand.
- Run one restore into an isolated network. Pick the client most likely to get a note like n0n’s, and time it. That is your answer to both the threat and the Databarracks figure.
- Check your contracts for incident notification. Who tells the ICO, and who tells you the clock has started.
- Ask whether any unmanaged client machines rely on File History. If so, apply KB5124006 or KB5124010 now, or wait for 13 October.
Backuptron’s weekly brief on backup and disaster recovery delivered as a service, read from Europe.
