Cyber Resilience for Virtualized Infrastructure: Backup Is Not Enough
Cyber resilience for virtualized infrastructure is the ability to keep critical services running through an incident, respond to it, and restore them to a known-good state. Backup is one component. You also need isolated copies, tested recovery procedures, a plan for the site and identity layers, and evidence that restores work within agreed targets.
Conceptual editorial illustration; not a product interface or measurement result.
The short version
Snapshots, HA, backup and disaster recovery each cover a different failure. None covers all of them, and none is proven until it has been restored or failed over under test.
- A snapshot is a short-term rollback point on the same storage. It is not a backup.
- HA restarts VMs after a host fails. It does nothing for deleted, corrupted or encrypted data.
- Backup gives you independent point-in-time copies, but only if those copies survive the incident.
- Disaster recovery restores services elsewhere when a site or platform is unavailable.
- Cyber resilience adds isolation, credential separation, recovery testing and decision-making under attack.
A maturity ladder: snapshot → backup → DR → cyber resilience
Most environments climb these steps in order. Each step assumes the one below it exists and works. The detailed differences between the first three are covered in snapshot vs backup vs disaster recovery; here the focus is what each step leaves exposed.
| Level | What it gives you | What it does not cover |
|---|---|---|
| 1. Snapshot | Fast rollback around a change | Storage loss, long retention, anything that reaches the same datastore |
| 2. Backup | Independent point-in-time copies and retention | Loss of the backup system itself, site outage, recovery at scale |
| 3. Disaster recovery | Restoring services at another location or platform | An attacker who also reached the DR copies or credentials |
| 4. Cyber resilience | Isolated copies, separated admin access, tested and measured recovery, incident decisions | Nothing is complete; it is maintained through testing and review |
Cyber resilience is more than recovery
NIST's ransomware community profile, IR 8374 Rev. 1, finalised in June 2026 against CSF 2.0, puts weight on preparing for recovery before an incident: protecting and isolating backups, and testing restoration. Saudi Arabia's National Cybersecurity Strategy frames resilience in similar terms — the ability to recover quickly from cyber events and incidents.
In practice that means three questions. Can the service keep operating, perhaps degraded, while you contain the problem? Do you know which copy is clean? And can your team restore the dependencies in the right order without the systems that were compromised — including the identity service and the management plane?
Failure domains in a virtualized environment
Start from what can fail, not from which product you own. A typical VM estate has at least six distinct failure domains:
- VM deletion or corruption — an admin error, a bad patch or a failed upgrade inside the guest.
- Host failure — CPU, memory, power or hypervisor fault on one node.
- Storage failure — a datastore, array or pool becomes unavailable or inconsistent.
- Ransomware or credential compromise — an attacker with admin rights can encrypt VMs and delete snapshots and reachable backups.
- Site outage — power, cooling, network or facility loss takes out the whole cluster.
- Operator error at scale — a script or policy change applied to many VMs at once.
The credential case is the one most designs underestimate. If the same directory account can manage the hypervisor, the backup server and the DR site, a single compromise can reach every copy.
Why HA does not replace backup or DR
High availability watches hosts and restarts VMs on healthy nodes. It assumes the VM's disks are fine. If a VM is encrypted, deleted or corrupted, HA will faithfully restart the damaged VM. Live migration and DRS solve planned maintenance and balancing, not data loss — see HA vs DRS vs live migration for how those three work together.
Replication has a similar limit. It copies changes quickly, which is useful for site loss, but it also copies corruption and encryption quickly. Point-in-time backups with retention remain the way back to a version from before the incident.
Decision table: failure scenario → protection mechanism
Use this to check for gaps. A row with no tested mechanism is a known exposure, not a hypothetical one.
| Failure scenario | Minimum mechanism | What proves it works |
|---|---|---|
| Bad change inside one VM | Snapshot taken before the change, removed afterwards | Rollback performed in a test window |
| VM deleted or corrupted | Point-in-time backup with retention | Single-VM restore and application check |
| Host failure | HA with spare capacity in the cluster | Controlled host failure test with restart observed |
| Storage failure | Backup stored off the primary storage | Restore to different storage |
| Ransomware / admin credential compromise | Isolated or separately administered backup copies; separate credentials | Restore from the isolated copy using only isolated credentials |
| Site outage | DR plan with a secondary location or platform | Partial or full DR exercise with measured recovery time |
| Mass operator error | Change control plus backups covering affected VMs | Multi-VM restore within agreed RTO |
What this means for Saudi organizations
The NCA Essential Cybersecurity Controls (ECC 2-2024) include backup and recovery management, and the related implementation guidance refers to periodic checks of how effectively backups can be recovered. The NCA Business Continuity Policy Template calls for periodic testing of DR plans, including live DR tests for critical systems where possible.
These documents describe what an organization must govern; they do not certify a technology. No hypervisor or backup product makes an entity compliant on its own. What a platform can do is make the controls easier to operate and the evidence easier to produce: restore logs, test records, retention settings and access separation.
If you are building that evidence, the next practical steps are a DR testing checklist for virtual machines and realistic RTO and RPO targets per workload tier.
Where VirtuWa fits
Asas HV provides the KVM virtualization layer, including snapshots and HA restart after host failure. Hemaya Backup & DR adds policy-based VM backup, restore workflows, retention and DR planning for VirtuWa workloads. VirtuWa also supports third-party backup tools over KVM-compatible workflows; see compatibility and engineering validation for what has been validated.
We do not publish generic recovery times: they depend on your data volume, storage, network and runbooks. The honest way to find your numbers is to measure them in a technical POC with your own workloads. Platform hardening and access separation are covered on the security page.
Sources and references
Frequently asked questions
What is cyber resilience for virtualized infrastructure?
It is the ability of a VM environment to keep critical services operating during an incident, respond to it, and restore services to a known-good state. It combines backup, isolation, DR, access separation and tested recovery procedures.
Is backup enough to recover from ransomware?
Not by itself. Backups reachable with the same admin credentials can be encrypted or deleted. You also need isolated or separately administered copies and a tested way to restore identity, network and applications in order.
Does high availability protect against data loss?
No. HA restarts VMs after a host failure. If the VM's data is deleted, corrupted or encrypted, HA restarts the damaged VM. Data loss needs point-in-time backups.
Are snapshots a backup?
No. Snapshots usually live on the same storage as the VM and depend on it. They are useful for short rollback around changes, not for independent recovery.
Does using VirtuWa make an organization NCA compliant?
No product makes an organization compliant. NCA controls are governed by the organization. A platform can support operating backup and recovery controls and producing test evidence.
Explore Hemaya Backup & DR
Review your failure domains and recovery approach with a VirtuWa engineer.
How to Test Disaster Recovery for Virtual Machines: A Practical Checklist
A practical DR testing checklist for virtual machines: what to test, what evidence to capture, pass criteria, and when to run tabletop, partial or full exercises.
Read articleRTO vs RPO for Virtualized Infrastructure: How to Set Realistic Recovery Targets
RTO and RPO explained for VM environments: how they differ, why zero targets are rarely sensible, illustrative tier examples, and how to test whether targets are achievable.
Read articleVM Snapshot vs Backup vs Disaster Recovery: What's the Difference?
Snapshot vs backup vs disaster recovery: what each one actually protects, why snapshots are not backups, and how to combine them safely.
Read articleHA vs DRS vs Live Migration: What's the Difference?
HA, DRS and live migration solve different virtualization challenges. Learn how they support availability, VM mobility and resource optimization.
Read article