What’s the least glamorous job in cloud infrastructure?
Easy: backup. Nobody puts it in a conference talk title. It’s the seatbelt of the cloud: mandatory, invisible, and interesting exactly once, on the worst day of your year.
Which is why the past year has been so strange to watch. Backup, of all things, turned into one of the most contested problems in the enterprise stack, and it happened because two groups with nothing else in common started asking about the same system at the same time: the security team and the AI team.
The estate nobody designed
Multi-cloud stopped being a strategy slide years ago. In Flexera’s 2026 State of the Cloud research, 83% of enterprises run active workloads on AWS and 79% run them on Azure. Sit with that overlap for a second. Most large companies are running both, right now, often with a private estate on the side.
Flexera’s explanation for the rise is refreshingly unheroic: mergers, SaaS sprawl, and decentralized teams. Nobody architected this. It accumulated.
In short: tape made backup a chore. The cloud made it a checkbox. Multi-cloud made it a mystery, because every provider ships its own tools, its own retention grammar, and its own dashboard, and none of them can see the others.
There’s a reason the mystery persisted, too. Backup budgets get approved on fear and audited on paper, and as long as the paper looked right, nobody went looking underneath it. The looking started when the incidents did.
That arrangement was survivable while backup stayed pure insurance. This year it stopped being pure insurance.
So what changed?
Two things, and they arrived from opposite directions.
The first is a new way to lose data. AI coding agents like Cursor, GitHub Copilot, and Claude Code now hold standing credentials against production systems, and when one runs the wrong command it does so at machine speed, through a fully authorized API call.
In April 2026, PocketOS founder Jer Crane watched a Cursor agent running Claude Opus 4.6 hit a credential mismatch in staging and resolve it by deleting a database volume. Nine seconds. Three months of reservations and customer signups went with it.
The backups went too, which is the part that should stop a backup owner cold. Inc.’s account of the incident notes an outage past thirty hours, and the agent’s own written explanation conceded the deletion was irreversible and that it should have asked first.
There was no intruder in that postmortem. The system did what it was told, faster than anyone could untell it.
The second is a measurement problem that had been sitting in plain sight. Eon’s 2026 AI Cloud Infrastructure Report, which surveyed 583 cloud IT leaders in March 2026, found a gap between confidence and reality that should unsettle anyone who owns an estate:
97% of organizations on three or more clouds trust their cross-cloud restore. 84% of that same group had a recovery failure in the past 12 months.
How does a gap like that survive inside careful organizations?
Dashboards report backup jobs, and a job is a copy operation that succeeded. A restore is a different physical act, exercised rarely, across systems that have changed since the last drill. Confidence compounds. Evidence expires.
So, the direct answer to this essay’s title: multi-cloud backup and recovery became interesting because it now carries two mandates at once. It is the last line of defense against ransomware and AI agent incidents, and it holds the largest governed dataset most enterprises can offer their AI programs. As of August 2026, one unglamorous system does both jobs.
The old threat kept its job
Ransomware, meanwhile, is still working its shift. Sophos’s 2026 State of Ransomware research found that 56% of attacks succeeded in encrypting data, and puts average recovery cost at $1.7 million, more than double the median ransom payment itself.
The detail that matters for backup owners: attackers learned years ago to go after recovery copies first, using stolen credentials, so the ransom conversation happens with your restore options already gone. Immutability and logical air-gapping went from compliance vocabulary to the load-bearing wall.
Immutability has a limit worth naming. An immutable copy of an already-encrypted database is still an encrypted database, and you can restore it perfectly and land straight back inside the incident you were trying to escape.
So the 2026 question is whether a copy is clean, and when it stopped being clean. That is where the newer platforms are separating themselves.
Put the two threats side by side and a pattern shows up. The ransomware crew attacks your copies. The AI agent corrupts your original. Either way, the question that decides the size of your bad week is the same: how fast can you get one specific thing back?
Backup is now the only system in the stack that answers to both the security team and the AI team.
The dataset hiding in the basement
Then the AI team showed up, which is the genuinely new part.
The same Eon report found that 57% of teams say data is the biggest barrier to AI progress, while only 11% point to models or tooling. Every AI program is hungry for governed, complete, historical data. And the best-governed dataset most enterprises own is sitting in their backups: classified, retention-managed, immutable, and, in the traditional model, unreachable without running a restore.
That’s why the architecture around backup storage is being rethought. Eon is the sharpest expression of the shift: it stores protected data in open table formats like Apache Iceberg, so the backup estate itself can be queried without having to restore and no ETL pipeline. The backup becomes a dataset that happens to be indestructible.
Once that’s possible, the budget conversation changes shape. Recovery and AI-readiness stop competing for money, because they’re the same storage layer wearing two hats.
What good looks like now
If you own one of these estates, the 2026 bar looks like this.
Coverage that proves itself continuously, because resources appear at machine speed and manual tagging misses them by Friday. Restores at the grain you lose data: a table, a record, a file. Storage deduplicated across clouds, which typically runs 30 to 50% below native snapshot pricing. One policy model across all three providers, so an auditor gets one answer. And a single owner with the standing to enforce it everywhere, because split ownership is where drift is born.
None of it is free, and it’s worth saying so. Cross-cloud platforms are cloud-only, so on-prem estates keep their own tooling. Consolidating protection means adding a vendor you have to trust deeply. And no control plane replaces the unglamorous habit of running restore drills on a calendar.
But the bar moved, and it moved for a reason. The teams meeting it are asking backup to hold a job it was never given before, and the ones who get there early will treat that as a competitive fact.
The seatbelt, reconsidered
Backup spent twenty years as the seatbelt of the cloud. Seatbelts are only interesting during a crash, and the systems replacing traditional backup are interesting on ordinary Tuesdays: they feed the analytics stack, they set how much autonomy the AI agents can safely get, and they give the auditor one story where there used to be three.
The security team and the AI team will keep arriving at this system from opposite directions. The enterprises that notice both groups are pointing at the same budget line will get there first.
Everyone else will keep buckling up and hoping.
