The morning nothing else worked.
Every other rung is an attempt to stop the bad day happening. This one assumes it happened anyway, which is the assumption a serious plan is built on. Ransomware got through, a server died, or somebody deleted a year of records while tidying up.
At that point exactly one question matters, and it is not how they got in. It is how far back you can go and how long it takes to get there.
Held apart, encrypted, and current.
Copies are encrypted on the machine before they leave it and held outside the systems they protect, which is the part that matters when an attacker has your network. A copy that the ransomware can reach as well is not a backup at all.
Working documents are captured continuously through the day rather than once overnight, so a file destroyed in the afternoon does not cost you the afternoon. Entire machines, servers in your building, and servers on a hypervisor are imaged so they can be rebuilt rather than reassembled from memory.
Microsoft and Google are not backing you up.
This surprises people every time. Microsoft and Google keep their own platforms available. Keeping a copy of what is inside your tenant is your responsibility, and their retention windows are shorter than the time it usually takes to notice a deletion.
On Microsoft 365 the mail, the files, the sites, and the Teams content are held by Cove. Gmail, Drive, Calendar, and Contacts on Google Workspace, your QuickBooks Online company file, and your Entra ID configuration are held on Dropsuite. All of them independently of the tenancy they came from.
A backup you have never restored is a belief.
The line that gets bought least and matters most is verification. It restores your protected systems on a schedule into an isolated environment, confirms they start, and produces a dated report with a screenshot attached.
That report is the thing to produce when an insurer or an auditor asks whether your recovery actually works. It is also how a failure surfaces during a quiet week instead of on the worst morning of your year, and when one surfaces our team chases it rather than filing it.
Lines on this rung
9 lines · rates per unit, per monthWorking File History
A running history of the documents your staff are genuinely editing. Changes are captured through the day rather than once at night, so a file destroyed at four in the afternoon does not cost you the afternoon.
- Documents, spreadsheets, and the folders staff work out of.
- Multiple restore points through the working day.
- Restore a single file or a whole folder to a chosen point.
- Encrypted on the workstation first, then stored where that workstation cannot reach it.
| Platform | N-able Cove |
|---|---|
| Scope | User documents and selected working folders |
| Frequency | Continuous through the working day |
| Restore | Single file or folder, to a selected point in time |
| Encryption | Applied on the device before transfer |
| Priced by | Windows workstation, monthly |
monthly, taken in advance QTY
Workstation Image Backup
The whole machine, not only the documents. The operating system, the programs, the settings, and the data, so a workstation that is stolen, drowned, or encrypted gets rebuilt instead of reassembled from memory.
- Full image capture including installed software and configuration.
- Restore to the same machine or to replacement hardware.
- Single files can still be pulled without a full restore.
- Suits the machines that would be painful to set up again.
| Platform | N-able Cove |
|---|---|
| Scope | Complete system image, applications and settings included |
| Restore | Same hardware, replacement hardware, or individual files |
| Schedule | Daily, adjustable |
| Encryption | Applied on the device before transfer |
| Priced by | Workstation, monthly |
monthly, taken in advance QTY
Physical Server Backup
Server grade protection for hardware running on your premises, with awareness of the applications that will not survive a naive file copy. Databases and directory services are captured in a state that can actually be restored.
- Application aware capture for database and directory workloads.
- Bare metal restore to the same or to replacement hardware.
- Restore an individual file, folder, or the entire server.
- Schedules that respect your business hours.
| Platform | N-able Cove |
|---|---|
| Scope | Full physical server, application aware |
| Applications | Database and directory services captured consistently |
| Restore | Bare metal, file level, or folder level |
| Encryption | Applied on the server before transfer |
| Priced by | Physical server, monthly |
monthly, taken in advance QTY
Virtual Server Image Backup
Image level protection for virtual servers on Hyper-V or VMware, taken at the host so the guest is captured whole. Recovery can bring the machine back where it was or on different infrastructure.
- Captured at the host, so the guest comes back complete.
- Restore to the original host or to different infrastructure.
- File level recovery without restoring the whole machine.
- Priced per virtual server, not per allocated core.
| Platform | N-able Cove |
|---|---|
| Hypervisors | Hyper-V and VMware |
| Scope | Full guest image |
| Restore | Original host, alternative infrastructure, or file level |
| Encryption | Applied before transfer |
| Priced by | Virtual server, monthly |
monthly, taken in advance QTY
Microsoft 365 Protection
Microsoft keeps your tenant running. Keeping a copy of what is inside it is your job, and this does that job. Mail, calendars, contacts, OneDrive, SharePoint sites, and Teams content, held independently of the tenant they came from.
- Exchange Online mail, calendars, and contacts.
- OneDrive for Business and SharePoint document libraries.
- Teams conversations and the files attached to them.
- Restore a single item, a mailbox, or a whole site.
| Platform | N-able Cove |
|---|---|
| Covers | Exchange Online, Teams, SharePoint, and OneDrive |
| Frequency | Multiple passes daily |
| Restore | Item, mailbox, or site, in place or exported |
| Retention | Held independently of the Microsoft 365 tenant |
| Priced by | Licensed user, monthly |
monthly, taken in advance QTY
Google Workspace Protection
The same argument, applied to Google. Gmail, Drive, Calendar, and Contacts copied out of the tenancy and held separately, so a deletion that has passed the trash window is still recoverable.
- Gmail with the labels and thread structure intact.
- Drive files including content in shared drives.
- Calendars and contacts for each covered account.
- Search across the archive without restoring anything first.
| Platform | Dropsuite |
|---|---|
| Covers | Gmail, Google Drive, Calendar, and Contacts |
| Frequency | Multiple passes daily |
| Restore | Item level or full account, in place or exported |
| Search | Across the retained archive |
| Priced by | Licensed user, monthly |
monthly, taken in advance QTY
QuickBooks Online Protection
Your books, copied. QuickBooks Online has no undo button worth the name once a bad import or a deleted list has settled in, and rebuilding a year of transactions is not a job anyone volunteers for.
- Transactions, lists, customers, vendors, and the chart of accounts.
- Daily capture with the ability to look at an earlier day.
- Restore records into the live company file or export them.
- Priced per company file, so multiple entities are straightforward.
| Platform | Dropsuite |
|---|---|
| Covers | Transactions, lists, and the chart of accounts |
| Frequency | Daily |
| Restore | Into the live company file, or exported |
| Scope | One QuickBooks Online company file |
| Priced by | Company file, monthly |
monthly, taken in advance QTY
Entra ID Configuration Backup
Your directory is the master key to everything else. This keeps a copy of its configuration: users, groups, roles, and the conditional access policies that decide who gets in, so a bad change can be seen and undone.
- Users, groups, roles, and application assignments.
- Conditional access policies captured as configuration.
- Comparison between days, so a change is visible.
- Restore selected objects rather than the whole directory.
| Platform | Dropsuite |
|---|---|
| Covers | Users, groups, roles, conditional access, and application assignments |
| Frequency | Daily |
| Comparison | Configuration differences between captures |
| Restore | Selected objects |
| Priced by | Tenant, monthly |
monthly, taken in advance QTY
Restore Verification
A backup you have never restored is a belief, not a plan. This restores your protected systems on a schedule in an isolated environment, confirms they start, and sends you the evidence with a date on it.
- Automated recovery of protected systems into an isolated environment.
- Confirmation that the system boots, with a screenshot as proof.
- A dated report, ready to give an insurer or an auditor.
- Failures are investigated by our team, not filed away.
| Platform | N-able Cove recovery testing |
|---|---|
| Method | Scheduled restore into an isolated environment |
| Evidence | Boot confirmation with screenshot and timestamp |
| Reporting | Dated result suitable for auditors and insurers |
| Failures | Investigated and resolved by the Fortify 24x7 desk |
| Priced by | Protected system, monthly |
monthly, taken in advance QTY
Where this rung stops
Backup is the most reassuring rung and the one most often misunderstood. These are its real edges.
- Recovery takes time proportional to the data. A full server restore is measured in hours, sometimes longer, and no product changes that arithmetic.
- Only what is enrolled is protected. A machine added to the business last month and never mentioned to us is not in any backup.
- Cloud protection depends on the provider interface. Some settings and metadata are not exposed by Microsoft or Google and therefore cannot be captured by anyone.
- Restoring data does not clean an infection. The recovery sequence after ransomware is rebuild first, then restore, and we will walk you through it in that order.
- A live break in is worked by the operations team through support, not by adding a subscription line. Say what you are seeing and we will tell you what happens next.
One more thing, stated where you can see it before you buy. Everything on this page is protective coverage bought in advance. It is not an emergency incident response retainer, and it does not put a responder on your site tomorrow because you subscribed today. An engagement of that kind is arranged directly with the Fortify 24x7 operations team. If something is under way as you read this, the quickest route to us is support@cyberthreat.help, or a case raised from your client portal.