When HCI Turns Backup into an Attack Surface

8 min read

HCI simplifies infrastructure-but doesn’t automatically make it secure. When virtualization, storage, networking, backup, and cyber protection converge on a single platform, a new core area emerges: the control plane. It decides who builds systems, protects data, and restores operations in an emergency. For security teams, it belongs in Tier 0.

Key Takeaways

Consolidation shifts risk. HCI reduces operational overhead but also concentrates permissions, APIs, backup jobs, and recovery paths in one place.
Backups need separation. Integrated protection only counts if immutable copies, separate admin roles, and an isolated restart are part of the plan.
Recovery is the real test. Before rollout, it must be clear which workloads come back in what order and who restores the control plane itself.

A contributed article by Markus Fritz, General Manager DACH at Acronis.
What is HCI with cyber protection? Hyperconverged Infrastructure combines compute, storage, networking, and virtualization in a unified operating model. Cyber Protection layers on backup, disaster recovery, security functions, monitoring, and management. Many tools become one platform that governs both operations and protection. The occasion is Acronis Cyber Frame, an HCI and IaaS platform for service providers. Acronis describes the solution as multitenant, starting at five nodes, and integrated into Cyber Protect Cloud. For SecurityToday, the product name matters less than the fundamental question: what happens when infrastructure, protection, and recovery share the same control point?

Why VMware’s restructuring is ratcheting up the pressure

Many service providers are currently re-evaluating their infrastructure. The Broadcom acquisition of VMware has set license models, contract logic, and migration plans in motion. Providers running IaaS are no longer assessing the next platform purely on technical merits; they’re also weighing margin, support pathways, multi-tenancy, and how quickly new capacity can be spun up. In this environment, HCI looks increasingly attractive: fewer discrete components, fewer interfaces, faster provisioning. For providers serving many small and medium customers, that’s compelling-classic virtualization stacks are notoriously hard to automate. Yet the very strength that makes HCI attractive is also its greatest risk: the more functions that converge on a single console, the greater the blast radius if an admin account is compromised. The Verizon Data Breach Investigations Report 2026 shows how deeply ransomware continues to drive real-world security incidents. These attacks increasingly target backup consoles, hypervisors, and management servers-where the leverage is far greater than on a lone file server.

48 percent

of breaches examined in the Verizon DBIR 2026 contain ransomware.

Source: Verizon Data Breach Investigations Report 2026

Where fragmented stacks let protection slip

The classic stack is rarely cleanly separated. There’s a virtualization console, a backup console, an RMM system, a security tool, bespoke scripts, and multiple provider portals. Each domain has its own roles, API keys, logs, and elevated privileges. On paper, that’s defense in depth. In practice, it’s drift: an ex-employee retains rights in an old backup tenant, an API key never expires, a service account can delete snapshots even though it’s only supposed to pull reports, an EDR alert never reaches the team that handles restores. In fragmented stacks, these gaps surface late-no one sees the entire chain. An integrated platform can shrink that surface. It can standardize permissions, tighten tenant separation, and merge backup, security, and operations into a single event stream. That’s not a free pass; it’s a trade-off: fewer blind spots in exchange for a more critical management layer.

The control plane belongs in Tier 0

When rolling out HCI with cyber protection, treat the control plane like an identity system. It needs phishing-resistant MFA, role-based rights, break-glass accounts, admin access only from hardened networks, and a separate log target that a compromised platform admin cannot delete. Crucially, delete authority must be split: an attacker encrypting production VMs should not also be able to wipe immutable backups or silence replicas. That sounds obvious, yet it often fails because of convenient super-admin roles. In multi-tenant environments, this separation must be technically and organizationally enforced-not merely visible in the UI. For customers, the audit question changes. It’s no longer enough to ask whether backup is integrated. The decisive factors are who can alter policies, who can launch recovery jobs, which actions require dual approval, and how long audit logs are retained outside the platform.

Consolidation only works with control points

Consolidation is not inherently a security issue. It becomes dangerous only when it’s treated as a shortcut. Good platform architecture reduces operational pressure in the environment but keeps control points visible. Poor platform architecture hides complexity behind a surface and sells the absence of friction as protection.

Pre-rollout checks

Roles: Uniform permissions and clear tenant separation must be established before migration.

Backups: Immutable copies require separate keys and dedicated deletion rights.

Recovery: Recovery runbooks need real workloads, dependencies, and clear sequences.

Logging: Platform events belong in a destination outside HCI administration.

The difference isn’t decided by the spec sheet. It’s revealed in the authorization concept, network segmentation, and whether the platform itself remains controllable after an attack. An HCI environment can accelerate recovery. It can also become the place where a single breach unlocks the most doors at once.

Rollout needs recovery proof

Before going live, the team shouldn’t just build a migration plan-it should build a restart plan. The first question: which systems must be back within the first hour? Next come identity, network, management, business processes, databases, and the order of dependencies. Without clear priorities, an incident will drown in equally loud voices and no reliable sequence.

Pre-rollout: Document roles, tenants, emergency accounts, API keys, and external log targets. Anything that can delete backups or alter snapshots gets its own review.

Pilot phase: Run restore tests with real dependencies. Don’t just recover a VM-verify the application, identity, DNS, network path, and monitoring together.

Post-launch: Recertify rights regularly, test break-glass accounts, audit immutable copies, and validate recovery times against contractual commitments.

Service providers should standardize these proofs. Customers don’t buy IaaS to learn forensics on the provider stack. They need a clear statement of which layers are protected, where their responsibility begins, and which recovery promises have been technically tested.

Pre-rollout demands clarity

The strongest HCI platform helps little if it’s treated in the security model like a standard admin portal. Before rollout, three things must be verifiable: separation of operations and backup authority, protection of the management plane, and a validated restart for both platform and customer workloads. This doesn’t make HCI with cyber protection less compelling. It makes the view more sober: linking infrastructure and protection lets you deploy faster, automate cleaner, and respond more orderly during incidents. The price is governance at a central level that was once scattered across multiple tools. For IT teams, that’s the real decision: consolidation can simplify operations, but it must not render the security architecture invisible. Only when recovery, rights, and logs remain independently auditable does an integrated platform become more than a new attack surface.

Frequently Asked Questions

What does HCI mean in this context?

HCI stands for Hyperconverged Infrastructure. It refers to an infrastructure architecture that combines compute, storage, networking, and virtualization within a unified operational model. In the service-provider context, IaaS is often added-i.e., the provisioning of virtual machines, storage, and network services for customers.

Why is the control plane critical?

The control plane manages production systems, tenants, permissions, backups, and restores. Whoever controls it can not only start or stop workloads but often alter protection mechanisms as well. That’s why it belongs in the same protection class as identity systems, domain controllers, and central admin tools.

What role do immutable backups play?

Immutable backups prevent saved data from being deleted or altered within a defined period. Yet they’re only part of the answer. Crucially, the roles for managing these copies must be separate, and keys, logs, and deletion rights must not end up on the same account.

Where’s the difference between consolidation and lock-in?

Consolidation lowers operational overhead when standards, roles, logging, and recovery processes become clearer. Lock-in arises when data, workloads, and operational processes are so tightly bound to a single platform that switching becomes nearly unmanageable. That’s why exit paths, export formats, and tested migrations belong in every architecture review.

Which checks belong before rollout?

Before rollout, teams should verify roles and super-admin rights, define external log targets, separate backup-deletion rights, run restore tests, and rehearse platform restart procedures. Also essential: break-glass accounts, MFA, API-key lifecycles, and a clear priority order for critical workloads.