Is cloud backup actually secure? I'm nervous about my data sitting in someone else's cloud.

The instinct is understandable: your data leaving the building feels like losing control. But look at how business-grade cloud backup actually works: data is encrypted on your systems before transmission, stays encrypted in transit and at rest, and the encryption keys mean the storage provider can't read your files. What sits in the data center is ciphertext - useless to anyone without the keys.

Now weigh that against what cloud backup protects you from. Ransomware's first move is encrypting or deleting any backup it can reach on your network - which is why on-site-only backups fail exactly when needed most. An off-site, immutable copy (one that can't be altered or deleted for a set period, even with stolen admin credentials) is the single most reliable ransomware recovery tool that exists. Fire, flood, and theft make the same argument: the copy that survives is the one that isn't in your building.

The questions worth asking your provider aren't 'cloud or not' but: Is data encrypted before it leaves our machines? Are the backups immutable? Is anything HIPAA-relevant handled with a business associate agreement? And above all - when was our restore last tested? An untested backup is where the real insecurity lives, cloud or otherwise.