Why Antivirus Alone Isn't Enough: The 3-2-1 Backup Rule

Antivirus software does real work on your device, but it was never meant to be the only thing standing between you and ransomware. CISA is blunt about the limit: no antivirus or anti-malware program can promise complete protection, and treating it as your sole defense while skipping routine operating-system and app updates is exactly the habit CISA warns against.

So keep your antivirus running and updated. But don't lean on it alone. What actually saves your files when ransomware hits is something else entirely: backups.

WHAT RANSOMWARE DOES TO YOUR FILES

Ransomware is malicious software that locks files by encrypting them, so the files — and any system that depends on them — can no longer be used. The attackers then demand payment in exchange for unlocking them. An attack can halt the work that depends on that data and leave an organization without what it needs to operate and deliver mission-critical services. It doesn't just touch one document — it can take the whole setup down, from your photos to the systems you rely on every day.

ANTIVIRUS IS A SECOND LINE OF DEFENSE — NOT A GUARANTEE

CISA treats antivirus and anti-malware tools as a useful second line of defense — protection that can help when a developer has not yet issued a patch for the flaw being exploited. That's a real job: it catches a lot of the routine stuff. It's just not a promise of complete protection, and the mistake is leaning on it alone while ignoring everything else. Keeping your operating system and apps updated matters too — see our guide to software updates, the briefing "Updates close doors attackers already know". But even a patched, well-guarded system needs one more layer before it's truly covered.

YOUR REAL SAFETY NET: BACKUPS

Here's the line that matters most, straight from CISA: "Backups are your best hope of recovery from a ransomware attack." Your best hope. Not your antivirus — your backups. A backup is your own secure copy of the data that matters, kept separately from your primary systems. When files are encrypted and attackers are demanding payment, a clean copy of your data stored somewhere separate means you can get back to work without them.

THE 3-2-1 BACKUP RULE

CISA's answer to the backup question is the 3-2-1 rule. Here's what it means:

• 3 copies of your important files. If one copy gets damaged or locked up, you still have spares.
• 2 different types of storage media — like a hard drive and the cloud. Two different types, so a problem with one doesn't take out both at once.
• 1 copy stored off-site, away from your location. Kept apart from your main setup, so nothing that happens at your location reaches every copy.

KEEP ONE BACKUP OFFLINE, AND TEST YOUR BACKUPS

CISA's full advice adds two more steps. First, keep backups offline and encrypted: one copy disconnected from your network, sitting apart from whatever is happening on your devices and your network. Second, test your backups regularly — practice restoring data, in full and in part, and make sure you can roll data back at least seven days if needed, so a restore is fast when it counts. A backup you have never tested is a hope, not a plan.

START BEFORE YOU NEED IT

Antivirus alone can't guarantee your files survive ransomware. Your safety net is a backup habit: three copies, two storage types, one off-site — kept offline and tested so you can restore fast.

Catch the 60-second Red Flag Cyber video on this topic, and grab the free Spot the Phish one-pager — five red flags to check before you trust an email — or practice with our spot-the-phish email quiz, the on-page quiz "Would you catch the phish?" at #quiz.

Sources: CISA StopRansomware ↗ · CISA on active OS, antivirus, and anti-malware protections ↗ · CISA: Level Up Your Defenses ↗ · CISA: Back Up Business Data ↗