Build a ransomware-proof copy this week or admit you're gambling

Build a ransomware-proof copy this week or admit you're gambling
Ransomware hunts your backups FIRST. It maps every mounted drive and encrypts them too. Playbook:
— Pick one offsite target the prod server can't write to directly
— Use a pull model: the backup box logs in and grabs data, prod never has the keys
— Turn on object-lock or immutability for 30 days, so even valid credentials can't delete
— Keep one copy fully offline, powered down between writes
— Test deleting a backup on purpose, it should refuse
A backup your hacked server can erase is not a backup. Fight me in the comments.