How does disaster recovery work after ransomware?

“Immutable snapshots and air-gapped storage mean the backup copy can't be encrypted or deleted by the attacker. We isolate the affected server, restore from the last clean snapshot, and hand you the incident log for your insurer.”