Keepit named “Best Security Solution for Data Management/Data Protection” for the second year in a row

Copenhagen, Denmark – May 8, 2025 – Keepit, a global provider of a comprehensive cloud backup and recovery platform, today announced its win at the Cloud Security Awards. Keepit secured the title of “Best Security Solution for Data Management / Data Protection” for the second year running, underscoring its position as a leader in cloud data protection. Keepit was also a finalist in the “Best SaaS Security Solution” category.

Headquartered in Copenhagen, Denmark, with offices in the US, Germany, France and the UK, Keepit provides leading data protection to over fifteen thousand companies across the globe.

“We’re proud to receive recognition for Keepit’s leading data protection platform. The continued move to store and secure data in the cloud has resulted in huge amounts of business-critical cloud data that is vulnerable to human error, ransomware attacks, or service provider downtime. Securing data in our vendor-independent cloud ensures uninterrupted access to your company’s most critical asset – data,” says Michele Hayes, CMO at Keepit.

Key benefits of the Keepit platform include:

• Data protection for all major SaaS applications in a single platform, including Azure DevOps, Dynamics 365, Microsoft Entra ID, Google Workspace, Microsoft 365, Power Platform, Salesforce, and Zendesk.
• Vendor-independent cloud: Keepit ensures backup data is stored separately from the production data, on its independent cloud, meaning data is always accessible even if a SaaS vendor has downtime.
• Data sovereignty: with seven isolated data center regions, Keepit’s customers can always be 100% certain that they can customize their backups to comply with local regulatory requirements.
• Instant recovery: fast, easy, and granular search and restore features means data can be located, previewed, and retrieved with just a few clicks.
• Certified, cloud-native design: Keepit is ISO/IEC 27001:2013 and ISAE 3402-II certified. Unique security and ransomware protection keeps data available and immutable by default.
• Predictable costs: customers pay one flat fee per user which includes unlimited data storage, ingress/egress, and retention.
• Simple and intuitive software: the simple interface and API-first architecture of the Keepit Platform requires no training, and can easily be integrated into existing systems, meaning customers can get up and running in minutes.

CEO of The Cloud Awards, James Williams, said: “We’re extremely proud to reveal the winners of The 2025 Security Awards. Cybersecurity is becoming more and more prevalent within the consciousness of people everywhere, not just within businesses. These awards provide a platform for those organizations that help keep our data safe and secure to celebrate their outstanding work.

Keepit has proven to amongst the very best in the industry at what they do – impressing our judging panel throughout the awards program with their ingenuity, and dedication to great security practice. We offer them huge congratulations on their deserved victory in what was a tightly-contested program. We look forward to seeing how they build on this success in the months and years to come.”

If you’re responsible for your organization’s data — whether in IT, security, compliance, or ops — there’s a good chance you’ve already dealt with some form of data loss. If not, odds are you will. The key is understanding how those losses happen and how to recover. 

In my experience, most incidents fall into one of four categories — I call them the four Ms: Malicious attacks, mistakes by admins, mishaps at your cloud provider, and migrations gone bad. 

Let’s take a look at each. Along the way, I’ll share real examples, the patterns I’ve seen over and over again, and what you can do to make sure you’re ready when (not if) something goes wrong. 

Malicious attacks: You will be targeted 

Let’s start with the one everyone knows: cyberattacks. You’ve seen the headlines — ransomware, data-wipes, stolen credentials, you name it. But what doesn’t always make the news is how modern attacks are increasingly hybrid and decreasingly targeted. 

We’re no longer dealing with isolated ransomware gangs. Today’s attacks are more coordinated, more hybrid, and less targeted than ever. Nation-state actors like MERCURY (now Mango Sandstorm) and DEV-1084 (now Storm-1084) have proven they can compromise on-prem environments, escalate privileges, and then pivot into cloud systems like Azure — where they delete Azure-based backups and try to erase the recovery path itself. That’s right: They don’t just go after your data, they go after your recovery plan. 

These aren’t theoretical. Microsoft’s Threat Intelligence blog and others have published chilling case studies on how hybrid attackers operate — and how hard they are to stop once inside. 

Attacks also don’t need to be that sophisticated to be devastating. Many start with a user doing something they shouldn’t — clicking a phishing link or exposing credentials. It’s not intentional, but it’s all an attacker needs to get in, elevate access, and start deleting data. 

Other times, it’s far more advanced. A state-sponsored actor might compromise your local AD, escalate access, and pivot into Azure using a synced identity. From there, they target and delete your backups. Not only is your operational data gone — your safety net is too. 

You might read this and think “well, no nation-state would target us,” but the sad fact is that attack technology always trickles downward. What takes a sophisticated team of experts today can be done by a ransomware gang next week and by a run-of-the-mill ankle-biter next month. As the ransomware market expands, and criminals compete with each other more, they’re being much less discriminating about who they attack, which increases the odds that you’ll get hit. An untargeted attack can do just as much damage to your business as one specifically aimed at you. 

Recovery tip: You can’t assume your backup is safe just because your data is in the cloud. Backups are often the first thing targeted —  here’s why backups are targeted. That means you need copies in a location your attacker can’t reach. Backups need to be immutable, isolated, and independent of your production systems. It’s not enough to say you have a backup. You need to know you can get it back when it counts. 

Mistakes by admins: The most common cause of data loss 

We all make mistakes. I’ve been in this field long enough to say that with confidence — even great admins on a good day can misconfigure something. The problem is, with today’s systems, small changes can have major ripple effects. 

Retention policies are a great example. Someone misconfigures a retention policy and sets it to 9 days instead of 90. Or a PowerShell script gets deployed with the wrong scope and clears out a folder structure. These are honest mistakes, but they carry real consequences. 

Then there are more complex cases — like the major U.S. bank that trusted its SaaS provider’s default retention policy. There was a bug in the logic. The result? Federally mandated records were deleted. By the time anyone realized, the recovery window had passed, and the bank’s risk committee had to be notified. 

No matter how well-trained your admins are, in a world where every IT team is under crushing pressure to do more, faster, with less, mistakes are guaranteed to happen. 

Recovery tip: Your backup strategy has to account for people. The good ones, the tired ones, the well-meaning ones who just made a bad change — and the ones who might mean harm. That means external, versioned backups you can access independently — even if someone on your own team made a critical change or deleted something maliciously. And more than that, it’s about building trust and a strong security culture. People need to feel comfortable admitting when something went wrong, before it escalates. 

Mishaps at your cloud provider: The shared responsibility reality 

Even the biggest cloud providers have bad days. In September 2024, Microsoft lost weeks of security logs for some customers due to a bug in their internal monitoring agents. Earlier, Google Cloud deleted critical pension data of one of Australia’s largest pension providers due to a misconfiguration of the Google Cloud VMware Engine (GCVE). The customer had no way to get it back through Google, but they fortunately had their own third-party backup in place. 

And these mishaps aren’t rare. These kinds of failures may be complex, but they’re not impossible. If your DR plan assumes your cloud vendor won’t mess up — or that they’ll be able to fix any problems they cause — you’re gambling. 

Recovery tip: Shared responsibility means your vendor protects the infrastructure — not your data. They essentially promise not to lose all of your data at the same time—not to help you recover if you lose all your data at the same time. If something gets deleted, overwritten, or lost due to their error (or yours), it’s your responsibility to recover. That’s why independent backup, stored off-platform and regularly tested, is so important. 

Migration gone bad: Underestimated and over-impactful 

Migrations should be straightforward — but they rarely are. They’re a little like home renovations in that they always take longer than expected, cost more than planned, and something breaks along the way. 

In larger transitions, like moving from one cloud provider to another, things can go completely sideways. A large EU retailer migrated to Google Cloud and experienced serious sync and data integrity issues. They didn’t have a rollback plan. Their recovery hadn’t been tested. They were stuck. 

We like to think of migrations as upgrades. But they’re also risk windows — times when data is in transit, systems are shifting, and safeguards are at their weakest. 

Recovery tip: Treat migrations like disaster scenarios. You need complete, point-in-time backups of everything critical before you cut over. And you need to test recovery as part of the migration plan. If you don’t, you might find yourself restoring yesterday’s lunch menu while your billing system stays offline. 

Final thoughts: Plan like it’s going to happen, because it will 

There’s a recurring theme in every scenario I’ve laid out: testing. Not theory. Not a spreadsheet. Actual, practiced, verifiable recovery testing. 

It’s not enough to say you have a disaster recovery plan. You need to prove it works — to yourself, to your team, and maybe even to regulators. That’s where real resilience comes from. Not from wishful thinking, but from preparation. 

You can’t predict every attack. You can’t prevent every mistake. And you can’t control what your cloud vendor does. But you can control how you prepare, and how quickly you bounce back. 

So test your plan. Test it again. And if it fails, fix it now — not during an actual incident. 

Cyberattacks are no longer just an IT issue — they’re a business survival issue, and so without a tested, resilient backup strategy in place, a ransomware attack or cloud outage can bring operations to a standstill. 

In the past, backup was just something someone took care of, and testing wasn’t done that often. But with the cyberthreats and regulations of today, backup needs to be more agile and at the heart of cyber resilience strategies. 

Organizations must balance disaster recovery (DR), backup systems, and security to ensure resilience against ransomware, data breaches, and operational disruptions.

Backup as the cornerstone of security 

In many cases, you don’t immediately know when an infection started, because some attackers deliberately wait for an organization to activate backups to strike deeper into the system. This makes it very difficult to find a clean backup — the last known-good state.  

That’s a tough challenge, which is why having historical backup data — and ensuring it’s quickly accessible, especially with hot storage — significantly improves the chances of a fast, complete recovery, minimizing downtime and financial loss. 

Having a backup that goes way back in order to get to that safe state helps to solve incidents. Often, incidents require deep analysis and cooperation with government and other entities to determine where/when you should roll back to. 

Cyber insurance providers recognize that a robust backup and recovery strategy is vital, which is why it’s a key insurability criterion. To qualify for coverage, organizations need immutable backups, regular testing, and vendor-independent storage in place as part of their business continuity plan to ensure real recoverability under real-world conditions. 

Comprehensive cybersecurity: From users to cloud providers 

Of course, it’s not only about backup; it starts with having a complete cybersecurity plan that covers everything from the user to backup systems and to partners in the cloud. Organizations must look at all the steps to protect themselves.  

For example, phishing is one of the most common attack methods used by bad actors. Phishing relies on tricking users into clicking a bait link or login, which, once interacted with, compromises the user’s system in various ways. Phishing attacks can lead to immediate execution of malicious code, harvesting of user-entered credentials, network compromise, and other impacts. 

Phishing attackers often escalate privileges and move laterally. This is why organizations must adopt a zero-trust approach — one where they always verify, never trust. No company has a full overview of all access and processes at all times. 

AI can help with visibility and control, but attackers also have access to AI, so it’s a continuous challenge. Offshoring, outsourcing, and cloud storage make control even more important — organizations must know where their data is (data sovereignty), who has access, and have more than one backup copy stored in a vendor-independent method, outside of the production data’s infrastructure. 

The cyber resilience mirage of single-cloud backups 

It’s risky to rely on the same cloud provider for both production data and backup data. If that provider experiences an outage, a cyberattack, or a policy change, organizations may lose access to their data — or even lose their data — because of the single point of failure. 

Part of cyber resilience means maintaining control over backups. This is done by storing backup copies in a vendor-independent cloud within the organization’s region and under its own governance. This isn’t just about choosing a backup provider, it’s about ensuring real recoverability and long-term security and compliance with current and future regulations. From my experience, it’s clear that organizations that control their own backups are better prepared for the unexpected.  

Backup as a board-level discussion 

Backup has historically been in the hands of system engineers, but it needs to be a discussion at the C-level. The key question is: If you don’t have access to Microsoft 365, what do you do? This is a risk management issue. 

Organizations need to move from just checking if backups exist to asking what happens if everything is gone — what’s the recovery plan? Cybersecurity strategies must integrate protection, access control, and recovery as cornerstones of business continuity. 

Conclusion 

Balancing disaster recovery, backup, and security is critical. The discussion must shift from compliance checkboxes to real operational readiness. Backup should be treated as a security asset, regularly tested, and protected. 

Organizations need to take control of their backup strategies, ensuring they have the ability to recover under catastrophic circumstances. Involving leadership, ensuring geographic redundancy, and integrating backup into cybersecurity strategies will enhance resilience. 

 The organizations that prioritize backup and disaster recovery as part of their overall security posture will be best positioned to withstand cyberthreats and maintain business continuity, as well as being better equipped to meet current and future directives and regulations like NIS2 and DORA. 

At Keepit, we believe backup shouldn’t be passive. It should give you awareness and insight — not just after something happens, but while it’s happening. That’s the thinking behind our newest feature: Anomaly Detection Dashboard. 

Anomaly detection helps you identify unexpected changes in your backup data, so you can act fast — whether it’s due to a mistake, a misconfiguration, a malicious attack, or something else. 

First, what is anomaly detection? 

Anomaly detection monitors backup snapshots and alerts you when there’s a significant change in your data — like a sudden drop in volume or a large number of files added or modified. 

Let’s say, for example, 30% of your tenant data disappears between snapshots, the system flags it. You’ll see exactly where the change occurred and when, so you can react quickly and investigate the cause. 

This is especially useful when handling: 

• Cyberattacks (e.g., encryption or mass deletion)  
• Accidental or unauthorized data removal  
• Unexpected configuration changes  
• Sudden data growth or reorganization 

It’s designed to help prevent major incidents — or at least minimize their impact — by giving you a clear signal that something’s different. 

Why anomaly detection matters for SaaS data protection

Many customers already use third-party tools to analyze what’s happening in their live environments. But they also want that level of insight in their backups — because backup is the last line of defense. 

With anomaly detection, backup becomes more than storage. It becomes a source of truth and a key part of your security strategy. This visibility supports faster decision-making and more confident recovery. 

Keepit’s Anomaly Detection Dashboard 

While similar functionality exists in the market, what sets Keepit’s approach apart is the end-to-end flow. Anomaly detection is directly connected to our platform’s built-in investigation and recovery tools — so you can go from alert to resolution without leaving your dashboard. 

From detection to recovery: a seamless workflow 

Anomaly detection integrates directly with Keepit’s comparison and restore tools, giving you a complete flow from alert to resolution. When an anomaly is flagged, you can:

• Compare the snapshot with its previous version 
• Drill down to see which folders or users were affected 
• Restore data at the folder or file level

This built-in workflow supports faster incident response — making it easier to validate the anomaly, identify the root cause, and recover only what you need. Everything happens within the same platform, with no need to switch tools or dig through logs manually. 

How anomaly detection works 

The Anomaly Detection Dashboard shows monthly trends and highlights any anomalies detected across your backup snapshots. 

Each anomaly includes:  

• Date of detection  
• Size change in gigabytes  
• Percentage change  
• Item count: the number of files added, modified, or removed 

Anomalies are classified into one of the following three types: 

• Added  
• Modified  
• Removed 

These categories help you quickly understand whether the change looks like a normal update — or something more critical. For example, a “removed” anomaly might point to mass deletions, while “modified” could be a sign of encryption. 

You can jump from any anomaly into a snapshot comparison, where you can:

• Filter changes by size or path  
• Drill into specific folders or users  
• Identify the exact files impacted  
• Restore folders or individual files if needed 

This lets you validate whether a change was expected — and if not, take action immediately.

What would a real anomaly detection incident look like? 

Here’s a hypothetical, yet realistic, example:

Let’s say you detect a 57% data removal, representing 5.1 GB missing from a snapshot. You can trace that removal to a specific user account and folder (such as a OneDrive Documents directory). You find three folders were deleted — either by accident, or as part of a suspicious event. 

From there, you can restore the data with one click — either at the folder level or file by file. Once restored, the incident is resolved, and your data is back and operational again. 

That’s the flow: Detect → Investigate → Recover. 

What to do when an anomaly is detected 

When an anomaly is flagged, the first step is to investigate it using Keepit’s built-in snapshot comparison tool. From the Anomaly Overview section, you can click into the specific event and compare the snapshot where the anomaly occurred with the snapshot that came before it. 

This allows you to:

• Browse affected folders and files 
• See exactly what was added, deleted, or modified 
• Understand the scope and significance of the change

If the anomaly is critical — such as large-scale deletion or suspicious modification — you can restore the most relevant backup version. Whether you need to bring back an entire folder or just a few files, you can act right away, all from within the same platform. 

Alerts, integrations, and SIEM support 

When an anomaly is detected, Keepit automatically sends an email alert to system admins. For organizations using SIEM or CIEM tools, anomalies are also logged in the audit log — giving you the option to parse and trigger workflows using your existing security infrastructure. 

Future releases will expand support for dedicated anomaly types within audit logs, allowing even more granular integration and filtering. 

Packaging, release date, and availability 

Anomaly detection will be included in the Enterprise Unlimited and Governance Plus packages. The feature will be available in the 10.5 release, scheduled for May 11, 2025.

For most eligible customers, anomaly detection will be enabled automatically. If you have a custom package or are unsure about your configuration, our customer success team is ready to help. 

Getting started 

Once the feature is enabled, you’ll find anomaly detection in the monitoring dropdown of your Keepit dashboard. There, you can explore anomalies, compare snapshots, and restore any data affected by unexpected changes.

Anomaly detection gives you real-time visibility into your backup environment — so you’re not just reacting to problems but staying ahead of them. 

At Keepit, we believe backup shouldn’t be passive. It should give you awareness and insight — not just after something happens, but while it’s happening. That’s the thinking behind our newest feature: Anomaly Detection Dashboard. 

Anomaly detection helps you identify unexpected changes in your backup data, so you can act fast — whether it’s due to a mistake, a misconfiguration, a malicious attack, or something else. 

First, what is anomaly detection? 

Anomaly detection monitors backup snapshots and alerts you when there’s a significant change in your data — like a sudden drop in volume or a large number of files added or modified. 

Let’s say, for example, 30% of your tenant data disappears between snapshots, the system flags it. You’ll see exactly where the change occurred and when, so you can react quickly and investigate the cause. 

This is especially useful when handling: 

• Cyberattacks (e.g., encryption or mass deletion)  
• Accidental or unauthorized data removal  
• Unexpected configuration changes  
• Sudden data growth or reorganization 

It’s designed to help prevent major incidents — or at least minimize their impact — by giving you a clear signal that something’s different. 

Why anomaly detection matters for SaaS data protection

Many customers already use third-party tools to analyze what’s happening in their live environments. But they also want that level of insight in their backups — because backup is the last line of defense. 

With anomaly detection, backup becomes more than storage. It becomes a source of truth and a key part of your security strategy. This visibility supports faster decision-making and more confident recovery. 

Keepit’s Anomaly Detection Dashboard 

While similar functionality exists in the market, what sets Keepit’s approach apart is the end-to-end flow. Anomaly detection is directly connected to our platform’s built-in investigation and recovery tools — so you can go from alert to resolution without leaving your dashboard. 

From detection to recovery: a seamless workflow 

Anomaly detection integrates directly with Keepit’s comparison and restore tools, giving you a complete flow from alert to resolution. When an anomaly is flagged, you can:

• Compare the snapshot with its previous version 
• Drill down to see which folders or users were affected 
• Restore data at the folder or file level

This built-in workflow supports faster incident response — making it easier to validate the anomaly, identify the root cause, and recover only what you need. Everything happens within the same platform, with no need to switch tools or dig through logs manually. 

How anomaly detection works 

The Anomaly Detection Dashboard shows monthly trends and highlights any anomalies detected across your backup snapshots. 

Each anomaly includes:  

• Date of detection  
• Size change in gigabytes  
• Percentage change  
• Item count: the number of files added, modified, or removed 

Anomalies are classified into one of the following three types: 

• Added  
• Modified  
• Removed 

These categories help you quickly understand whether the change looks like a normal update — or something more critical. For example, a “removed” anomaly might point to mass deletions, while “modified” could be a sign of encryption. 

You can jump from any anomaly into a snapshot comparison, where you can:

• Filter changes by size or path  
• Drill into specific folders or users  
• Identify the exact files impacted  
• Restore folders or individual files if needed 

This lets you validate whether a change was expected — and if not, take action immediately.

What would a real anomaly detection incident look like? 

Here’s a hypothetical, yet realistic, example:

Let’s say you detect a 57% data removal, representing 5.1 GB missing from a snapshot. You can trace that removal to a specific user account and folder (such as a OneDrive Documents directory). You find three folders were deleted — either by accident, or as part of a suspicious event. 

From there, you can restore the data with one click — either at the folder level or file by file. Once restored, the incident is resolved, and your data is back and operational again. 

That’s the flow: Detect → Investigate → Recover. 

What to do when an anomaly is detected 

When an anomaly is flagged, the first step is to investigate it using Keepit’s built-in snapshot comparison tool. From the Anomaly Overview section, you can click into the specific event and compare the snapshot where the anomaly occurred with the snapshot that came before it. 

This allows you to:

• Browse affected folders and files 
• See exactly what was added, deleted, or modified 
• Understand the scope and significance of the change

If the anomaly is critical — such as large-scale deletion or suspicious modification — you can restore the most relevant backup version. Whether you need to bring back an entire folder or just a few files, you can act right away, all from within the same platform. 

Alerts, integrations, and SIEM support 

When an anomaly is detected, Keepit automatically sends an email alert to system admins. For organizations using SIEM or CIEM tools, anomalies are also logged in the audit log — giving you the option to parse and trigger workflows using your existing security infrastructure. 

Future releases will expand support for dedicated anomaly types within audit logs, allowing even more granular integration and filtering. 

Packaging, release date, and availability 

Anomaly detection will be included in the Enterprise Unlimited and Governance Plus packages. The feature will be available in the 10.5 release, scheduled for May 11, 2025.

For most eligible customers, anomaly detection will be enabled automatically. If you have a custom package or are unsure about your configuration, our customer success team is ready to help. 

Getting started 

Once the feature is enabled, you’ll find anomaly detection in the monitoring dropdown of your Keepit dashboard. There, you can explore anomalies, compare snapshots, and restore any data affected by unexpected changes.

Anomaly detection gives you real-time visibility into your backup environment — so you’re not just reacting to problems but staying ahead of them.