DEV Community: Ryan Beglau

Your Door Badges Are on the Network

Ryan Beglau — Fri, 30 Oct 2026 17:42:26 +0000

Between October 17 and October 26, 2026, ransomware closed three school districts and sent two hospitals back to paper. In Idaho the attackers took the cameras, the door locks and the heat before anyone saw a ransom note. Here is what ten days of headlines say about the recovery plan you have, and the five moves to make before the next one.

01 — The incidents: Ten days, in order

Saturday, October 17. Jerome, Idaho. School district

Alerts fired overnight and teachers started reporting that the network was wrong. By the time the Jerome School District, about 4,000 students across eight schools, understood what was happening, attackers controlled the surveillance cameras, the electronic door locks, the heating and cooling, and the internet. The district closed every school Monday and Tuesday and rescheduled parent-teacher night. Attackers accessed student data and demanded a ransom; the district has declined to say whether it paid. Superintendent Brent Johnson called the cameras, locks and HVAC “core systems to make sure that our students are safe.” Schools reopened Wednesday.

The same weekend. Falls City, Nebraska. Hospital

Community Medical Center locked down its computer systems after unauthorized access damaged parts of the network. Ambulances diverted critical patients to other hospitals because images could no longer reach radiologists. Appointments were canceled or delayed, staff went back to pen and paper, and the emergency room stayed open. The hospital decided to replace its computers and deploy an entirely new network, with expedited equipment shipments and help from a larger health system. The CEO expected slower services for most of the following week. Local reporting named a ransomware group; that attribution has yet to be independently established.

Tuesday, October 21. Richmond, Virginia. School district

Teachers at Richmond Public Schools arrived to ransom notes on their laptops and no Wi-Fi, cameras, phones, copiers, Smartboards, Chromebooks or PowerSchool. A week later, the network was still unavailable and the district was still teaching without its digital resources.

Wednesday, October 22. Oneonta, New York. School district

Oneonta City School District discovered a separate ransomware attack and closed schools Friday and Monday while it worked out what was affected, including whether student records were taken.

Monday, October 26. Albuquerque, New Mexico. Health system

UNM Health diverted ambulance traffic to other area health systems from 12:30 to 2:30 p.m. MT while security teams protected the network. Clinical appointments and Health Sciences classes were canceled. Normal operations returned the next day. A group has claimed patient, student and employee data on a leak site. UNM has confirmed none of it, calls the incident a cybersecurity event under criminal investigation, and told the public to ignore anyone claiming responsibility.

That is five organizations in two sectors inside ten days, with different attackers as far as anyone has confirmed. The incidents follow the same pattern.

02 — The mechanism: Why the door locks go first

Field Notes No. 02 opened with the sentence that the ransomware call rarely starts with “our files are encrypted.” It starts with something more immediate: “the phones are down, the badge readers stopped working, and the cameras are dark.” Jerome was that sentence, word for word.

The mechanism is familiar to anyone who has walked a school or a hospital with a network diagram. Over the last decade, many of the systems that keep a building safe moved onto the same network as everything else: cameras, badge readers, HVAC controllers, bell schedules, PA systems, the visitor kiosk at the front office. In the environments we assess, most of them authenticate against the same directory as the staff laptops, sit on the same flat VLAN as the student information system, and get managed from the same admin workstation (the convenience is real, which is how it happens). Attackers who hold one administrator account usually hold all of it. They do the walking-around work first: map the environment, find the recovery infrastructure, find the physical systems. The encryption comes last, which is why the first symptom is a door that will neither lock nor unlock.

That ordering turns an IT outage into a safety decision. A superintendent with no cameras and no working locks will close the building. A hospital that has no way to move images to a radiologist will divert an ambulance. By then the outage has already cost the week, whatever happens with the ransom.

It also decides your restore order, the subject No. 02 spent the most time on. Safety systems are the first thing attackers take and the reason the building stays closed, so they belong in the Tier 1 recovery group next to identity and phones, with their own documented restore steps and their own manual overrides. Most plans I review file them under facilities, and facilities usually has no restore procedure for them.

03 — Threat intelligence: The entry point attackers are using this month

There is no public attribution tying the school incidents above to any single vulnerability, and I will keep it that way. What is public is which entry point is being used across these sectors right now.

Unit 42, the research team at Palo Alto Networks, reports that ransomware operators have been exploiting CVE-2026-0257, a critical authentication bypass in PAN-OS GlobalProtect portals and gateways, since June 2026, with updated activity reported in October. Attackers establish VPN sessions without valid credentials, sidestep multi-factor authentication, and move laterally. Named victim sectors include education, healthcare and government. A patch is available. One tactic stood out in the reporting: pivoting into the virtualization layer to disable security controls and dump credentials. Your hypervisor is part of the attack path now, which is worth reading alongside this week’s other headline, a VMware ESX logging flaw that CISA added to its Known Exploited Vulnerabilities catalog after a state-linked group used it to erase audit trails.

The same week, Microsoft 365 tenants at 79 organizations were compromised by replaying stolen session tokens, with attackers registering rogue devices and rewriting inbox rules to keep access behind the MFA prompt. MFA stays mandatory, and it stops being sufficient the moment an edge device or a token is the thing being stolen. In No. 10 one client went from about 60% to about 95% patch compliance by automating the work; the GlobalProtect bypass is the kind of hole that difference closes.

Perimeter VPNs, firewalls and the virtualization layer are the three places this month’s attackers are living. They need a shorter patch clock than the general estate, measured in days, and a backup design that assumes the hypervisor administrator account is already gone, which is the design No. 04 lays out.

04 — Recovery: Recovery times inside the same ten days

Jerome and Oneonta each lost two school days. Richmond was still down a week later. Falls City budgeted most of a week and bought new computers. UNM diverted ambulances for two hours and was normal the next morning.

Reported time to normal operations, October 17 to 26, 2026

UNM Health (Albuquerque, health system): 2-hour ambulance diversion, normal the next morning
Jerome School District (Idaho, K-12): 2 school days closed
Oneonta City School District (New York, K-12): 2 school days closed
Community Medical Center (Falls City, Nebraska, hospital): Most of a week, on new computers and a new network
Richmond Public Schools (Virginia, K-12): Network still unavailable a week later

Reported closure or reduced-service window from each organization’s statements and the coverage listed in Sources. Richmond was still down when this note was filed.

Those are five different recovery time objectives, and only the organizations involved know what drove each one. The pattern across the incidents we have worked matches it, though. Recovery time comes down to three things: whether the organization can rebuild identity and core networking into a clean environment quickly, whether it holds a copy of the data attackers could neither encrypt nor delete, and whether anyone has rehearsed the order things come back in. Falls City’s decision to stand up an entirely new network is the heavy version of a clean rebuild, done under pressure with trucks of hardware. A pre-staged recovery environment is the same decision made in advance.

The No. 02 sequence still holds: contain and declare, then identity and network into a clean environment, then the systems that decide whether the building opens, then everything else in a business-approved order, then prove the attacker is gone before you call it recovered. Ten days of headlines changed none of it. They added evidence for the part most of the plans we review skip, which is timed restore tests run before the bad morning, with the safety systems in scope.

05 — Healthcare: The hospital version

A hospital’s recovery time shows up as ambulance diversions. UNM’s two-hour window and Falls City’s radiology bottleneck teach the same lesson at two scales. A dependency that looks like plumbing becomes a clinical decision the moment it fails, and the image transfer to the radiologist, the lab interface and the bed board all belong on the Tier 1 list with a known manual fallback and a known restore time.

Two things UNM did deserve copying. It communicated through channels it controlled and told the public to engage with nobody claiming responsibility, which keeps the attacker out of the narrative and keeps staff from clicking on things. And it described the incident only in terms it could prove, a cybersecurity event under investigation, rather than repeating the attacker’s claims. Discipline in the first 48 hours is part of the recovery plan, and it can be written down in advance like everything else.

06 — The plan: Five moves before the next one

Inventory every physical system on the network, then segment it. Cameras, badge readers, HVAC, PA, bells, visitor management. Each gets its own VLAN, its own credentials, and a documented manual override: who holds the physical keys, how the heat runs without the controller, how a building opens with the badge system down.
Put the edge and the hypervisor on a days-long patch clock. GlobalProtect and the ESX flaw in CISA’s catalog are this month’s examples. Measure compliance monthly and report the number to leadership, the way No. 10 describes.
Hold one copy attackers can neither encrypt nor delete. Immutable, outside production credentials, restore-tested. The replication target and the backup console must stop trusting the same directory as the laptops.
Write the restore order with safety systems in Tier 1. Identity, network, phones, badges and cameras, then the student information system or the clinical systems, then everything else. Name the owner of each item.
Rehearse it with a stopwatch, and decide the hard questions in advance. Who declares, who calls the insurer and counsel, which channel the incident team uses when email is gone, and what the organization’s position on paying is before anyone is asking at 2 a.m.

07 — Our services: How we run this at ModernOps

This section describes our own services, so read it with that in mind.

The districts and hospitals above each had an IT team doing everything it could on the morning it happened. The difference between a two-hour incident and a two-week one is work done months earlier, and that work is what we sell. In our co-managed model we operate the recovery side of a customer’s existing environment: the immutable copy, the documented restore order with physical and clinical systems in Tier 1, and the scheduled, timed restore tests with results leadership and insurers can read. In our hosted model, replication flows into recovery infrastructure we operate in our Pennsylvania and Arizona data center regions, pre-staged and isolated from the customer’s production credentials, so the clean environment already exists on the bad morning instead of arriving on a truck.

We work with school districts and local governments on familiar procurement paths, and the first engagement is usually a restore test rather than a purchase.

Disclosure: Section 07 describes ModernOps services. The incident details above come from the organizations’ own statements and the reporting linked in Sources, as of October 29, 2026; attacker claims are marked unverified and details may change. Validate every control against your own environment.

08 — Assessment: The 60-second check

Read these aloud. Any “no” belongs on the plan before the next headline.

Every camera, badge reader and HVAC controller sits on a segmented network with its own credentials, and someone can open the building and run the heat with all of them offline.
The VPN, firewalls and hypervisor have been patched within days of the last critical advisory, and you can show the number.
At least one backup copy is immutable and unreachable with production administrator credentials.
A written restore order exists, safety and clinical systems are in Tier 1, and each entry has an owner.
A timed restore test ran in the last six months and the incident team has a communication channel that survives losing email.

If the renewal clock or the budget cycle already has you reviewing the environment, the free Rapid Infrastructure Resiliency Assessment scores backup, recoverability, immutability and failure tolerance, remote-first, with a prioritized plan you can take to a board or a school committee.

09 — Primary reading: Sources

Cybernews: Hackers take control of school cameras, locks, and HVAC, shutting down entire Idaho school district (Jerome School District, October 17; superintendent quotes)
Becker’s Hospital Review: Cyberattack diverts critical patients from Nebraska hospital (Community Medical Center, weekend of October 17 to 18)
MSC News: CMC in Falls City targeted by Cyber Attack (Community Medical Center)
Kaseya: The Week in Breach News: October 28, 2026 (Richmond Public Schools, October 21; Oneonta City School District, October 22)
Cyware: Cyware Daily Threat Intelligence, October 24, 2026 (Oneonta closure; Unit 42 reporting on CVE-2026-0257 exploitation; Microsoft 365 token-replay campaign)
UNM Health Sciences: Ambulance traffic diverted, clinical appointments cancelled and classes cancelled due to cybersecurity issue at UNM HSC (October 26 to 28, with follow-up guidance)
HIPAA Journal: University of New Mexico Health System Diverts Ambulances Due to Ransomware Attack
The Hacker News: China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility (CVE-2026-41709, CISA KEV)
ModernOps: Field Notes No. 02, No. 04 and No. 10, for the recovery sequence, the immutability rules and the patch-compliance results this piece builds on

Ryan Beglau, filed from Conshohocken, PA, October 2026

Originally published at modernops.com.

Disclosure: I work for ModernOps, and section 07 describes our own recovery services. The incident details come from the organizations' statements and the public reporting listed in Sources, as of October 29, 2026. Validate every control against your own environment.

Put the Microsoft Tools You Already Pay For to Work

Ryan Beglau — Thu, 29 Oct 2026 11:24:18 +0000

Our Microsoft practice helps clients use what they already own. Here's what that work looked like for one client, and how we estimate the value of an automation project.

01 — The practice: What the practice does

Our Microsoft engagements focus on five things:

Remove bottlenecks in everyday processes
Put unused Microsoft capabilities to work
Consolidate overlapping software spend
Address security weaknesses
Automate ongoing security tasks

02 — Licensing: $85,200 in annual software renewals removed

This client was renewing three separate tools every year. Their existing Microsoft licensing included Defender capabilities that covered the security functions they needed.

We moved them over. Their existing retainer covered the migration, so there was no additional project fee.

Removing those three renewals avoided approximately $85,200 in annual licensing costs. That figure excludes our service fees.

03 — Staff time: An estimated 39 staff hours freed each month

The same client's IT team handled patching, setup and account cleanup by hand. We automated those tasks. That freed an estimated 39 hours a month for other work.

Their payroll stayed the same. The benefit was time the team could spend elsewhere. That can translate into cash savings when it reduces overtime or avoids an additional hire.

04 — Security: Patch compliance improved from 60% to 95%

Patch compliance was about 60% in December 2025. By September 2026, it was about 95%.

DEC 2025: 60%
SEP 2026: 95%

Patch compliance, one anonymized client, approximate.

We also removed more than 900 unused guest accounts for external users.

Patching and account cleanup now run through automated processes. Unpatched machines and forgotten accounts can give attackers a way in, something anyone who has worked a ransomware weekend knows too well.

05 — Beyond IT: Where to look beyond IT

The same approach applies to work elsewhere in the business. Some useful places to start:

Sales: How long does a new lead wait before a rep follows up?
Finance: How many people handle an invoice before it gets approved?
Operations: Where do requests sit while one team waits on another?

For a repeatable task, we estimate the value of the time saved:

The formula

Monthly capacity value = Tasks per month x Staff hours saved per task x Loaded hourly cost

For example, suppose a team processes 400 invoices a month and automation saves 15 minutes of staff time on each one.

That frees 100 hours a month. At a loaded hourly cost of $60, the capacity value is $6,000 a month, or $72,000 a year.

This is a hypothetical example. The calculation values time available for other work. To assess whether a project is worthwhile, compare that benefit with the cost of implementation and ongoing support.

06 — Checklist: Questions to ask about your Microsoft environment

Ask whoever runs your IT, whether that's an internal team or an outside provider:

Which Microsoft capabilities are included in our licenses but still unused?
Which software renewals overlap with those capabilities?
What does the team still do by hand, and how many hours does it take each month?
What percentage of our devices meet our patching policy today?
Which external users still have access to our files, and who still needs it?

About the figures

The licensing reduction, staff-time estimate, patch-compliance figures and guest-account cleanup come from one anonymized ModernOps client. Figures are rounded estimates. The $85,200 represents annual software renewals avoided and excludes service fees. The invoice calculation is an illustrative example, separate from the client results.

Originally published at modernops.com.

Disclosure: I work for ModernOps, and this piece describes our own Microsoft practice and one anonymized client engagement. Figures are rounded estimates; the $85,200 excludes service fees; the invoice calculation is an illustrative example. Validate against your own environment.

Veeam Just Gave Your VMware Exit a Safety Net

Ryan Beglau — Fri, 21 Aug 2026 19:02:44 +0000

Backup & Replication 13.1 shipped on July 29 with the two Proxmox VE features everyone was waiting for: replication and Instant Recovery. Here is what works today, what remains on the roadmap, and how to leave VMware without betting the company on the move.

01 — The two features everyone was holding out for

For two years, the same conversation has repeated in every VMware renewal review we run. The customer wants off VMware. The renewal quote made the decision for them. Proxmox VE is on the shortlist because the numbers work, and we walked through those numbers in Field Notes No. 01.

Then somebody asks the adult question: what happens to our disaster recovery?

Until this week, the answer was a compromise. Veeam has backed up Proxmox VE since 2024, but two capabilities that VMware shops treat as table stakes were missing: VM replication and Instant Recovery. Veeam's own forums filled up with IT teams and service providers saying they were holding migration projects on those two features alone.

On July 29, Veeam shipped Backup & Replication 13.1. Both features are in it.

02 — What shipped

Straight from Veeam's What's New documentation, dated the same day.

Replication for Proxmox VE. VM-level replica jobs, including direct host-to-host replication without shared storage and cross-data center replication. Replicas can land on a different storage type than the source. True replica semantics, rather than a backup copy with extra steps.

Instant Recovery to Proxmox. Boot a VM on Proxmox VE directly from a backup of nearly any platform Veeam protects, then migrate it to production storage. Sources include vSphere, Hyper-V, Nutanix AHV, physical servers via Agent, AWS, Azure and Google Cloud. The source list is the whole point.

The boring plumbing. VirtIO drivers are injected automatically when you restore a non-Proxmox VE backup onto Proxmox VE, and restored VMs can carry VLAN tags. Veeam calls the VLAN feature out as being for migration scenarios, which tells you how they expect this to be used.

Veeam's framing in the same document: workload migrations are accelerating, and Veeam is built to move with them. The subtext is loud. The same release added five more hypervisors to the supported list. Veeam is positioning itself as the portability layer for the post-Broadcom data center.

03 — The question everyone will ask

So can I replicate my VMware environment to a Proxmox VE target?

No. Replica jobs in 13.1 run Proxmox VE-to-Proxmox VE only. Cross-hypervisor replicas are absent, and continuous data protection for Proxmox VE is absent too. What you can do across hypervisors is restore-based: back up the VMware VM, then restore it, or Instant Recover it, onto Proxmox VE. The practical difference is the recovery point.

Replica-based DR: a warm standby VM and a recovery point measured in minutes. In 13.1 this requires Proxmox VE on both ends.
Restore-based DR: a recovery point equal to your backup frequency, and a recovery time equal to a restore, or to a boot-from-backup with Instant Recovery. Works VMware to Proxmox VE today.
The status caveat: Instant Recovery to Proxmox VE ships under Veeam's experimental support status. It works, and Veeam will take your ticket, but nobody should write it into a contractual RTO yet.

Our publishing rule is that the fine print sits next to the promise. Instant Recovery to Proxmox VE is real and it is useful, and it is also labeled experimental in this release. We treat it as the bonus path until it graduates, and we quote recovery times from timed full restores, because that is the number a business can hold us to.

04 — The DR-first migration

Here is the play this release enables, and it is the safest VMware exit pattern we know how to run.

Phase 1, now: keep VMware. Point your DR at Proxmox VE. Production stays exactly where it is. Your Veeam backups gain a second life: on a schedule, restore the important VMs onto a Proxmox VE environment and prove they boot, network, and serve. Recovery stays restore-based, with the recovery points you already run. The part I like most is that every DR test is now a migration rehearsal. Instead of wondering whether your workloads could run on Proxmox VE someday, you watch them run on Proxmox VE this quarter, with a stopwatch out, while VMware still carries production.

Phase 2, at renewal: cut over on your schedule, not Broadcom's. When the renewal numbers say go, the cutover is the procedure you have already run: final backup, restore to Proxmox VE, validate, move the network. If an application misbehaves on the new platform, restores run in both directions, so the retreat path is the same tool as the advance path. That symmetry is what makes this a safety net instead of a trapeze.

Phase 3, after: real replication, Proxmox VE on both sides. After the cutover, your production Proxmox VE cluster replicates, VM by VM, to a second Proxmox VE site, including a different data center on different storage. Now you have warm-standby DR with tight recovery points, on the platform you just moved to, from the backup vendor you already own.

If the ransomware recovery playbook taught one lesson, it is that recovery is a sequence you rehearse rather than a product you buy. That lesson stands. This release just makes the rehearsal cheaper and the sequence portable.

05 — The fine print that belongs in your plan

We verified these against the release notes and Veeam's forum statements this week. Plan around them.

Missing: Cloud Connect support at initial release. Confirmed by Veeam product management on the R&D forums. The classic multi-tenant model, replicate to your service provider, has yet to arrive for Proxmox VE. Provider-side replication has to be built co-managed, with one backup server that can see both sites. Watch this one: when Cloud Connect lands, Proxmox VE DRaaS becomes turnkey.
Experimental means experimental. Instant Recovery and granular RBAC for Proxmox VE both carry experimental support status in 13.1. Useful in a rehearsal, though never something to write into a contractual recovery time until Veeam graduates them.
Replica jobs have rough spots. From the release notes: a replication job can fail when a source disk's size sits off the target storage's block-size boundary, and TPM devices ignore per-VM storage mapping for now.
RHEL 10 family restores need one setting. RHEL, CentOS and Rocky 10, restored onto Proxmox VE from another hypervisor, may refuse to boot until you change the VM's processor type from the default x86-64-v2-AES to x86-64-v3. One line in VM settings, easy to script, brutal to discover at 2 a.m.
Version floors. You need Backup & Replication 13.1 with the version 13.4 Proxmox plug-in, and Proxmox VE 8.2 through 9.2. Keep in mind that v13 dropped vSphere 6.x support entirely, so the longer a legacy environment waits, the fewer doors stay open.
Backups are still the foundation. A replica will never be a backup. It happily replicates your ransomware along with your data. Everything in Field Notes No. 04 still applies: at least one copy immutable, isolated from production credentials, and restore-tested. Replication raises availability. Immutability is what gets you back when an attacker is inside.

A word on Nakivo. Veeam is the tool this piece covers because it is what most of our customers already own, and this release means they can keep it through a Proxmox VE move. If you are shopping rather than standing pat, Nakivo deserves a serious look. It shipped agentless Proxmox VE backup, replication and instant recovery ahead of Veeam, it is an official Proxmox VE solution provider, and in the quotes that cross our desk it tends to land at roughly half the cost of comparable Veeam licensing. It is a good product, and we say that as a shop that quotes both. The takeaway is the same either way: the Proxmox VE DR tooling grew up, and whichever backup vendor you pay probably supports it now.

06 — How we run this at ModernOps

We built our managed recovery practice in two forms, and this release slots into both. In our co-managed model, we operate the customer's existing Veeam estate: we add a Proxmox VE recovery environment, schedule the restore tests, run the stopwatch, and keep the runbook current. In our hosted model, replication and restores flow into Proxmox infrastructure we operate in our Pennsylvania and Arizona data center regions, pre-staged and isolated from the customer's production credentials, with Backup as a Service underneath it on enterprise storage with immutability built in.

The new 13.1 capabilities change our answer to one question we hear weekly. When a mid-market IT director asks whether they can get off VMware without gambling their disaster recovery, the answer is now: keep VMware, DR onto Proxmox VE with us, rehearse until the timings bore you, cut over when your renewal calendar says so, and fail back if you ever need to. We will run the stopwatch either way.

07 — The 60-second exit-readiness check

You know your VMware renewal date and the current quote, per core, in writing.
You have booted one of your production workloads on Proxmox VE, from your own backups, in the last quarter.
Your recovery point for Tier 1 systems is written down, and restore-based DR meets it, or the plan gets you to Proxmox VE-to-Proxmox VE replication.
At least one backup copy is immutable and outside production credentials, on both the old platform and the new one.
If the cutover went wrong at hour six, you know in minutes how long the restore back to VMware takes.

A "no" is simply the next item on the rehearsal schedule. If the renewal clock is already ticking, this is exactly the work our free Rapid Infrastructure Resiliency Assessment scores.

08 — Sources

Veeam, Backup & Replication 13.1 Release Notes, GA July 29, 2026
Veeam, 13.1 What's New, Hypervisor Protection section
Veeam R&D Forums, Proxmox VE replication scope and Cloud Connect timing
Veeam Help Center, Restore to Proxmox VE, supported source workloads and Proxmox VE 8.2 to 9.2
NAKIVO, Proxmox VE replication and Instant Recovery documentation
ModernOps Field Notes No. 01, No. 02 and No. 04: the economics, the sequence and the rules this builds on

Originally published at modernops.com.

Disclosure: I work for ModernOps, and section 06 describes our own managed recovery services. The product capabilities and limitations above are drawn from Veeam's public documentation and forum statements listed in Sources. Verify them against your own versions before you build on them, and expect the details to shift as 13.1 matures.

If Your Admin Can Delete the Backups, You Do Not Have Backups

Ryan Beglau — Wed, 29 Jul 2026 14:32:35 +0000

Ransomware operators routinely target backup infrastructure. Immutability keeps a compromised administrator account from wiping out the copies you need to recover. Here is how it works, and how to tell whether you actually have it.

01 — The question I ask during backup reviews

During most infrastructure reviews, I eventually ask the same thing. The answer tells me more than a screenshot of successful backup jobs ever will.

If your most senior administrator's credentials were stolen at 2 a.m., could that account delete every copy of your backups?

Most companies have backups. Most also have something offsite. The problem is that the backup console, storage repository, replication target, and cloud copy often trust the same directory. One domain administrator can reach all of them.

That design works until the administrator account is compromised. At that point the attacker does not need to break four different systems. They only need to become the person who already has permission to manage them.

02 — Backups are part of the attack plan

Attackers target backup systems because working backups take away much of their leverage. A company that can restore its systems has far less reason to pay. Veeam's ransomware research has reported that backup repositories were targeted in roughly 96% of attacks, and in about three-quarters of those cases the attackers affected at least some of the repositories.

There is a large difference between believing recovery will work and proving it will work.

Veeam's 2026 Data Trust and Resilience research reports that about 90% of organizations believe they can recover from a cyber incident, but fewer than one in three ransomware victims fully recovered their data. The same research found that organizations using controls such as immutable storage and automated backup verification reported full recovery at more than twice the rate of organizations that did not.

Immutability does not guarantee an easy recovery. It does remove one of the simplest ways an attacker can make recovery impossible. What recovery looks like once an attacker succeeds is its own discipline; we wrote that sequence down in the ransomware recovery playbook.

03 — Replication and snapshots are not immutable

These terms get mixed together constantly, and the difference is the whole point.

Replication is not it. Replication makes another copy, but it keeps copying changes from the source. Encrypt or delete the source and the damage can replicate too. A 15-minute schedule can give you two corrupted copies.
A snapshot is not either. A standard snapshot can still be deleted by an administrator. With stolen admin credentials, that snapshot is already within reach. Deletable is not protected.
The real test. A snapshot is immutable only when the platform stops anyone, administrators included, from deleting it before retention expires. No account can shorten it.

The immutability test in one question: can any account in your environment shorten the retention period or delete the copy before it expires? If the answer is yes, the copy is not truly immutable. That applies to your internal team, your MSP, your storage administrator, and anyone else with elevated access. The control must still hold when the attacker is operating through a trusted account.

04 — How the platforms lock it

Two platforms we deploy handle this well, in different ways. The mechanics are worth knowing, because the word "immutable" hides real differences in how the lock is actually enforced.

Pure SafeMode: the eradication timer. When data is deleted from a FlashArray it first enters an eradication-pending state. It is not destroyed immediately. The default timer is 24 hours. With SafeMode it commonly extends to 14 days, and up to 30 days on FlashArray, with longer options on FlashBlade. If an attacker deletes a volume, the data stays recoverable until the timer expires, which gives the operations team time to notice and intervene.

Pure SafeMode: off-box authorization. SafeMode retention cannot simply be shortened or disabled from the array console. The organization designates authorized contacts, at least two and up to five, and changes are verified through Pure Support. A stolen array password is not enough to remove the protection, and one rogue administrator cannot quietly disable it. The destructive action is separated from the person managing the array day to day.

NetApp SnapLock: tamperproof snapshots. Tamperproof snapshots use SnapLock technology to retain a snapshot for a defined period. The snapshot cannot be deleted before that period expires, including by an ONTAP administrator. That provides a fast local recovery point without leaving deletion authority in the hands of one administrator.

NetApp multi-admin verification. Multi-admin verification adds approval requirements to sensitive ONTAP operations: deleting volumes or snapshots, or creating new administrator accounts. A compromised account may be able to request the action, but it cannot complete the action by itself. Autonomous Ransomware Protection adds another layer, watching for workload behavior associated with ransomware, including unusual encryption activity.

Pure and NetApp implement these controls differently, but the design goal is the same: one identity should never hold enough authority to destroy every usable recovery point.

05 — Using the 3-2-1-1-0 rule

The traditional 3-2-1 backup rule is still useful, but it does not fully address ransomware. Veeam popularized the expanded 3-2-1-1-0 model:

3 copies of your data.
2 different storage media or platforms.
1 copy stored offsite.
1 copy immutable, air-gapped, or offline.
0 recovery errors, confirmed by verified restore testing.

The final two are where many backup designs fall apart. A company may have several copies across multiple locations, but every copy is still managed through the same identity system. Or the company has an immutable copy but has never completed a clean, timed restore from it.

A successful backup job only confirms that the system wrote data somewhere. It does not confirm that the business can recover its applications, databases, permissions, dependencies, and operations within an acceptable amount of time.

An untested backup remains an assumption.

06 — The operational work behind immutability

Buying the feature is the easy part. Keeping it correctly configured is ongoing work.

Retention and capacity. Retention has to match risk and recovery requirements and still fit available capacity. Locked snapshots consume space, and a policy that gets too expensive comes under pressure to be shortened.
Contacts and approvers. Authorized-contact and MAV approver lists need maintenance as people change roles or leave. A two-person approval does not work when one of the two left six months ago.
Testing and monitoring. Restores must be scheduled, performed, timed, and documented, or the zero in 3-2-1-1-0 is unproven. Someone also has to notice when a deletion timer starts running.

A lean internal IT team can manage all of this. The challenge is continuing to manage it after the original implementation project is over and the team has moved on to the next priority. That is one of the reasons we built our Backup as a Service offering.

ModernOps provides backup on enterprise storage with immutability included in the operating model. We design retention around the customer's RTO and RPO, maintain the required approval controls, and perform scheduled restore tests with documented results. Customers get an immutable backup design without needing to own and operate the storage platforms behind it. More importantly, someone remains responsible for keeping the design working month after month.

07 — The 60-second immutability check

A "no" or "not sure" identifies something that needs review:

At least one backup copy is locked so no account in your environment can delete it before retention expires.
Shortening or disabling that protection requires approval outside the normal administrative console.
The retention period is longer than the time an attacker could realistically remain undetected.
You have completed a clean, timed restore from the immutable copy in the last six months.
The authorized contacts and approvers are current employees with the correct responsibilities.

If a VMware renewal or storage refresh already has you evaluating the environment, it is a good time to address the backup design too.

08 — Sources

Veeam, Ransomware Trends Report (backup repositories targeted in ~96% of attacks)
Veeam, Data Trust and Resilience Report 2026 (recovery confidence vs. full-recovery rates; immutability and verification doubling full recovery)
Pure Storage, SafeMode snapshots documentation
NetApp, ONTAP SnapLock and Multi-Admin Verification documentation
Veeam, 3-2-1-1-0 backup rule guidance

Coming next in Field Notes: many companies assume Microsoft is backing up their Microsoft 365 tenant. Microsoft expects customers to understand where its responsibility ends. Field Notes No. 05 covers that gap.

Originally published at modernops.com.

Disclosure: I work for ModernOps, and section 06 describes our own Backup as a Service offering. The platform details and statistics are based on vendor documentation and the public research listed in Sources — validate all settings and capabilities against your own platforms and software versions.

The Reverse Information Paradox: Don't Lose Your Crown Jewels

Ryan Beglau — Wed, 29 Jul 2026 14:12:03 +0000

By Chris March, ModernOps. Republished with permission from our Field Notes blog — posted here by his colleague Ryan Beglau.

You pay for intelligence with money — and then you pay again with something far more valuable: the proprietary knowledge you hand over to make that intelligence useful. That second bill is the one nobody reads carefully.

01 — The second bill

Satya Nadella published a short piece last week called "The Reverse Information Paradox." If you work anywhere near AI strategy, it is worth the ten minutes. I want to unpack why it matters, because it puts language to a problem I run into almost every week with midsize enterprises.

Here is his core idea. Back in the 1960s, the economist Kenneth Arrow described a paradox in the market for information. A seller cannot prove the value of what they know without revealing it, and once they reveal it, the buyer has it for free. AI flips this around. Now the buyer is the one at risk. You pay for intelligence with money, and then you pay again with something far more valuable: the proprietary knowledge you have to hand over to make that intelligence useful. The better you want the model to perform, the more of your own knowledge you feed it. And the whole time, the seller is learning more about you while you learn almost nothing about what they are learning in return. Doesn't seem very smart does it?

That second bill is the one nobody reads carefully. And it is the one that should keep leaders up at night.

02 — The speed trap

Most midsize companies I talk to are not debating whether to use AI. That ship sailed. They are racing. Leadership wants wins on the board, and they want them this quarter. So the business side sprints, and the governance and risk teams end up cast as the people slowing everyone down. Sometimes business wants it, but they're not sure where to even start, so they feed Claude all their information, and get something back regurgitated, but they haven't built anything sustainable. It's simply saved a few minutes versus changed their operating model.

I have a lot of sympathy for both sides. The pressure to move is real. Nobody wants to be the company that got smoked because legal was still reviewing a data processing agreement. But the governance folks are not wrong either. They can see what the sprint is quietly giving away… at least that's the credit I'm giving them. Sometimes, they're completely naïve. That naivety is also crippling because it stifles progress when they realize what happened and articles like Satya's come out.

Here is where it gets structural. Most of these companies already have big cloud agreements in place. Committed spend, negotiated discounts, the whole thing. So when AI shows up, the path of least resistance is obvious: buy the bundled capability from the platform you are already locked into. Swipe the card you already have. It is fast, it is easy, and it looks efficient on paper.

The trouble is that buying instead of building is not a neutral choice. It is a decision about who gets smarter over time. And in the default setup, it is not you.

03 — Protect your jewels, man!

This is the part that Satya nails and that most organizations miss. Models do not just learn from the data you formally load in. They learn from the exhaust. The prompts your people write. The tools your agents reach for, and most of all, the corrections your experts make when the model gets something wrong.

The prompts your people write — every hard question your business is working through, in their own words. Written daily. Never audited.

The tools your agents reach for — a live map of how your operation actually gets work done. Learned from silently.

The corrections your experts make when the model gets something wrong. Fifteen years of judgment, one trace at a time. The expensive one.

Think about what a correction actually is. It is a senior person on your team, someone you have paid for fifteen years to develop judgment, telling the model exactly how your business thinks about a hard call. That is not data. That is institutional know-how. It is the stuff a competitor could never buy at any price. And in the buy-everything model, it leaks out one trace at a time, one correction at a time, so slowly that nobody ever files an incident report about it.

Author's note: This stuff drives me nuts. We cannot outsource experience. We certainly shouldn't give it away. In consuming intelligence, you are creating intelligence — and what you create should belong to you.

Nadella puts it well. If learning only ever flows in one direction, then over time the value piles up with whoever owns the learning infrastructure, not with the company that generated the knowledge in the first place.

For a midsize enterprise, your data and your team's judgment are the whole ball game. It is the one thing that makes you hard to copy. Handing it over as a byproduct of a convenient purchase is the most expensive mistake I see companies make without realizing they are making it. It's early, but keeping down the path of buying off the shelf will prove costly when you have to right the ship, and at that point, the cat is out of the bag.

04 — The false choice

So the market hands leaders what looks like a clean tradeoff. Move fast and buy, and accept the leakage. Or protect your data and build, and accept that you will be slow and it will turn into a science project.

Option A — Move fast and buy. Accept the leakage. Swipe the card you already have. Fast, easy, efficient on paper — and the default setup quietly decides who gets smarter over time. It is not you. Convenient now. Costly later.

Option B — Protect and build. Accept the science project. Guard the data and build it yourself — pitched as a two-year platform overhaul while the market moves without you. Safe. Slow.

I do not accept that tradeoff, and neither should you. It is a false choice, and it exists mostly because the buy option is packaged so conveniently and the build option gets pitched as a two-year platform overhaul.

That gap is exactly why we built our approach at ModernOps the way we did and partner with those who don't settle for large consulting bills, but rather outcomes, fast.

05 — The pitch

We take a blended approach. The goal is to get you from proof of concept to a real business outcome in under twelve weeks, and to do it in a way that builds the foundation instead of digging a hole you have to climb out of later.

Speed and governance are not opposing forces when the architecture is right. We get you moving fast on the use cases that matter, and at the same time we set the trust boundary so your sensitive data stays inside your four walls. Your evals, which are really just your own definition of what "good" looks like, stay yours. Your traces, your corrections, your institutional memory, all of it accumulates on your side of the line and compounds into an asset instead of leaking out as exhaust.

We also keep the orchestration layer decoupled from any single model. That is a quiet but huge point in Satya's piece. If the one model you built everything around gets pulled, repriced, or deprecated tomorrow, can you still operate? Can you still hit your evals with a different model underneath? If the answer is no, you do not own your capability. You are renting it, and the landlord sets the terms.

Do this right and every AI initiative stops being a cost you re-pay every quarter and starts being IP you own. Your team's judgment gets captured, protected, and reused. The learning loop runs inside your walls and gets better every cycle. That is the difference between spending on AI and compounding on it.

06 — The point

Satya framed the problem cleanly: a company should be able to use a model without giving up the knowledge that makes it unique. That is the reverse information paradox, and confronting it is not a philosophy exercise. It is a set of decisions you are making right now, whether you know it or not, every time your team picks the easy path.

You are going to pay for intelligence. That is fine. Just make sure you're not losing your crown jewels in the process.

Originally published by Chris March at modernops.com.

Disclosure: Chris and I both work for ModernOps, and sections 04–05 describe our own services. Read them with that in mind — the framing in sections 01–03 and 06 stands on its own either way.

When Ransomware Hits, the District Stops

Ryan Beglau — Wed, 15 Jul 2026 18:55:03 +0000

A recovery playbook for schools and local government. Backups are not the plan. This is the sequence that gets identity, phones, payroll, transportation, and critical services back online in hours instead of weeks.

A few numbers to frame the problem: 82% of reporting K-12 organizations experienced cyber threat impacts per the CIS K-12 Cybersecurity Report; Uvalde CISD canceled four days of classes after ransomware; and federal support for MS-ISAC ended on 09.30.25.

01 — The bad morning

The ransomware call rarely starts with "our files are encrypted." It starts with something more immediate: "the phones are down, the door badges stopped working, and we cannot see the cameras."

When Uvalde CISD confirmed ransomware in September 2025, the district canceled four days of classes because the attack disrupted phones, air-conditioning controls, security cameras, visitor management, and Skyward. That is what a modern district attack looks like. It does not just take data hostage. It takes Tuesday hostage.

02 — The attack before the attack

Your backups are usually the first target. Modern ransomware crews do not encrypt on arrival. They map the environment, escalate access, and find the recovery infrastructure first. If the backup plane trusts the same identity system the attacker controls, one stolen administrator account can compromise production and recovery together.

The fix is architectural. At least one recovery copy must be immutable inside its retention window and inaccessible through production credentials. If every copy can be changed by the same administrator, every copy is inside the blast radius.

Three failure modes to check for:

Shared trust. Production and backup administration use the same identity plane. One compromise, two environments.
Untested recovery. A successful backup job proves data was written. It does not prove operations can return on time. Green check, unknown outcome.
Vendor blast radius. The PowerSchool incident showed how one third-party credential can expose data across many districts. Your plan must include their failure.

03 — The only numbers that matter

Backups answer whether. RTO and RPO answer when and how much. "We have backups" is not an operating commitment. Leadership needs two approved numbers for every critical workload, and IT needs a timed test proving the environment can meet them.

RTO — recovery time objective (hours): how long can the service stay unavailable before the district or municipality cannot operate?

RPO — recovery point objective (lost data): how much recent data can the organization accept losing between the last safe copy and the attack?

04 — Recover in a sequence. Not in a panic.

The first 72 hours decide whether this is a hard week or a lost month. These are illustrative targets, not promises: your real recovery time comes from rehearsing your own environment with a stopwatch.

T+0 — Contain and declare. Minutes, not meetings. Isolate the affected network. Call your insurer, counsel, and incident-response firm. Move communication to a channel the attacker cannot see. Cut lateral movement, preserve evidence, activate out-of-band communications.

T+0–4h — Restore the foundation (Tier 0). Recover identity and core networking into a clean environment. Nothing else can come back safely until trust and connectivity are restored: identity services, DNS, DHCP, core network, privileged access controls.

T+4–24h — Reopen operations (Tier 1). Bring back the systems that determine whether school opens and public services continue. Use the immutable copy as the source of truth: SIS and payroll, phones and transportation, safety and visitor systems.

T+24–72h — Recover in order (Tier 2). Restore the remaining environment in a business-approved sequence. Validate every workload before reconnecting it to production: department applications, file services, validation and monitoring.

T+72h+ — Validate and close. Service comes back before trust does. Confirm eradication with your forensics team, rotate every credential, and keep heightened monitoring in place until the environment has re-earned normal operations.

Recovery principle: isolate affected systems and restore from a clean, offline backup. CISA's StopRansomware guidance recommends maintaining offline backups and regularly testing their availability and integrity.

05 — Back online is not the same as recovered

The restore sequence ends in days. Full recovery takes weeks, and most of it is invisible: proving the attacker is out, proving the data is right, and closing the door they came through. Re-entry through leftover access is how a two-day outage becomes a repeat incident.

Full recovery is declared, not assumed. It ends with evidence:

Eradication proven. Forensics closes the entry point, persistence is hunted down, every credential is rotated, and monitoring watches for re-entry.
Data validated. System owners check restored records against known-good points. Grades, payroll, permits: the departments confirm the data is correct, not just present.
Readiness rebuilt. A fresh immutable baseline, replication re-enabled, the runbook rewritten with what the incident taught, and the next timed failover on the calendar.

06 — Recovery already standing by

A district can build all of this in-house. The honest question is whether a lean IT team can maintain a second recovery environment, protect it from the production blast radius, rehearse it on a schedule, and keep the documentation current while still running everything else. That is why ModernOps runs recovery two ways.

Model A — Managed DR: your infrastructure, run with discipline. Keep the backup and DR investment you already own. ModernOps operates and documents it: immutability verified, restore order written down, restores tested and timed on a schedule, and evidence reports that leadership and insurers can read.

Model B — Hosted DRaaS: we run the recovery side for you. Replication flows to a recovery environment ModernOps hosts and operates: pre-staged, isolated from district credentials, and rehearsed with your team. On the bad morning, failover starts with a call to an engineer who already knows the environment.

Recovery requirement	Built during the incident	Run by ModernOps
Clean environment	Designed under pressure	Pre-staged and isolated in advance
Recovery copy	May share production trust	Locked, immutable snapshots
RTO and RPO	Assumed until tested	Defined, tested, and timed
Bad-morning support	Start with a new ticket	Call an engineer who knows the environment
Documentation	In one engineer's head	Runbooks and test evidence kept current

In either model, recovery stops being a binder and becomes an operation. Replication runs continuously. Restores are tested on a schedule and timed. Documentation stays current because keeping it current is the job. Backup is delivered as BaaS on enterprise storage with immutability built in, and failover is covered by DRaaS with defined RTO and RPO.

07 — The 60-second check

Any unchecked item belongs in the recovery plan. This is a quick screen, not a resilience score:

One recovery copy is immutable and isolated from production credentials.
RTO and RPO are written, approved, and tied to specific systems.
A clean restore has been completed and timed in the last six months.
Identity, network, payroll, SIS, and safety systems have an approved restore order.
The incident team has an out-of-band way to communicate.

08 — Sources

09 — Find your real recovery window before someone else does

The free Rapid Infrastructure Resiliency Assessment scores backup, recoverability, immutability, and failure tolerance in a few hours. It is remote-first, carries no obligation, and ends with a prioritized gap list you can act on.

Originally published at modernops.com.

Disclosure: I work for ModernOps, and sections 06 and 09 describe our own managed recovery services. The incident reporting and statistics cited are drawn from the public sources listed above.

The 3-Host VMware Trap, and the Escape Hatch That Costs About Half

Ryan Beglau — Wed, 08 Jul 2026 15:09:04 +0000

Broadcom went subscription-only, hardware prices are spiking, and small clusters now pay enterprise rates. Here's the math, and what a hosted alternative actually looks like.

I work for ModernOps, a VAR and MSP outside Philadelphia. Every week I see renewal quotes land on the desks of IT managers running the most common infrastructure footprint in the mid-market: three VMware hosts, shared storage, somewhere between 20 and 80 VMs. And every week the reaction is the same. Someone forwards the quote with a one-line email: "Is this right?"

It's right. Here's what changed, what it actually costs now, and the escape hatch we built for exactly this situation.

01 — What Broadcom actually did

When Broadcom closed the VMware acquisition, it ended perpetual licensing entirely and collapsed roughly 168 products into four subscription bundles. The two SKUs small shops actually bought are gone: the Essentials Plus kit was retired, and vSphere Standard hit end-of-sale on July 31, 2025. If you're a three-host shop, the product you're being quoted today is vSphere Foundation (VVF), a bundle priced per core, with a 16-core minimum per CPU, packed with features you may never touch.

The renewal increases being reported publicly range from 150% to over 1,000%, and analyses focused on small business specifically put the typical jump at 350–450%. Miss your renewal anniversary and there's a 20% late penalty waiting.

02 — The 72-core asterisk

In April 2025, Broadcom announced a 72-core minimum per order, meaning a small shop buying licensing for one modest server could be forced to license 72 cores. Reporting since then conflicts: some sources say it took effect and drove 200–350% increases on small and edge deployments; others say it was walked back after backlash, leaving the 16-core-per-CPU floor.

Here's the thing: it almost doesn't matter. Even at the 16-core floor, per-core subscription pricing punishes small clusters. Do the math on yours.

03 — The math on your three hosts

Take the standard build: three hosts, dual socket, 16 cores per socket. That's 96 licensable cores.

Your renewal, itemized:

hosts × sockets × cores: 3 × 2 × 16 = 96 cores
VVF, reported list: $150–$190 /core/yr
your renewal: $14,400 – $18,240 /yr
same cluster, old Standard: ≈ $3,600 /yr

VVF list pricing has been reported at $150–$190 per core per year depending on term. So your three boxes now cost $14,400 to $18,240 a year in licensing alone.

What did the same cluster cost on the old vSphere Standard model? On the order of $3,600 a year. Same three servers. Same workloads. Four to five times the licensing bill, before you've bought a single piece of hardware.

04 — The refresh doesn't save you

The usual answer is "fine, we'll refresh the hardware and ride it out." That plan got expensive too, because AI demand is eating the component supply chain.

TrendForce reported conventional DRAM contract prices up roughly 93–98% quarter-over-quarter in Q1 2026, the largest quarterly jump on record, with another 58–63% projected for Q2 and NAND up 70–75%. Gartner projects DRAM up around 130% year-over-year for 2026.

+93–98% — DRAM contract price, Q1 2026, QoQ · largest jump on record
+17% — Dell list-price increase, Mar 2026 · Cisco, Lenovo, HP & HPE followed at 10–15%
24+ wks — Lead times on popular server configs, up from ~10 weeks

Server vendors passed it through fast. Dell raised list prices roughly 17% effective March 30, 2026 across its lines including PowerEdge; Cisco raised compute pricing in early March; Lenovo, HP, and HPE followed with increases in the 10–15% range. Memory now represents as much as a quarter to a third of a server's bill of materials (a 32GB DDR5 server module that sold for about $149 was quoted near $239 roughly two months later), and lead times on popular configs stretched from around 10 weeks to 24 or more.

So the "keep vSphere, buy new hosts" plan means: pricier boxes, a much pricier license attached to every core in them, and a wait measured in quarters.

05 — Why Proxmox changes the denominator

Proxmox VE is the open-source hypervisor platform that a lot of the VMware exodus is landing on: over 1.5 million hosts under management worldwide, twenty years of development, and a built-in import wizard that pulls VMs straight off ESXi. Its developers estimate the large majority of typical vSphere environments migrate cleanly.

The economics are structurally different: Proxmox is licensed per socket, not per core, and the software itself is free. Enterprise repository support runs about €550 per socket per year on the Standard tier.

6 sockets × €550 ≈ €3,300 (~$3,600) /yr — clustering · live migration · HA · backup · SDS included

Six sockets across your three hosts is roughly €3,300 (~$3,600) a year, with clustering, live migration, HA, backup integration, and software-defined storage in the box.

That's the old vSphere Standard number. The one Broadcom took away.

06 — The part nobody tells you

Here's the honest catch: a two- or three-person IT team doesn't want to become a Proxmox operations team. Migrating a hypervisor is real work, and running one well (patching, clustering, storage tuning, backup verification, capacity planning) is a permanent job, not a project.

That's the gap we built for. ModernOps runs Proxmox at scale in our own infrastructure, behind a custom front end that gives your team the cloud experience (a self-service portal, fast provisioning, monitoring, predictable monthly billing) without you owning a single host. Compute lands on our IaaS. Recovery is covered by DRaaS with defined RTO and RPO. Backup is delivered as BaaS on enterprise storage with immutability built in.

Because it's one platform serving many clients, you get economies of scale a three-host shop can't reach alone. And when something breaks at 2 a.m., you call a phone number and an engineer answers. Not a chatbot. Not a ticket queue in another hemisphere.

07 — Where the savings actually come from

People assume hosted means marked up. It's the opposite, and the reasons are structural.

Start with redundancy math. A three-node cluster running N+1 keeps a full third of its hardware in reserve: you bought three hosts to safely use two, and you're paying to power, license, patch, and warranty all three either way. A ten-host platform cluster running N+2 reserves 20% instead of 33%, and that reserve is shared across every workload on the platform rather than parked for one company's bad Tuesday. Less idle iron per VM is a real, recurring saving.

Then there's the boring part, which is the point. Every host in our fleet runs one extremely by-the-book configuration: same firmware, same network layout, same storage design. Upgrades follow a defined cadence with documented, repeatable procedures, validated before they touch production. Predictable systems fail less, and when something does misbehave, troubleshooting a known configuration takes minutes instead of a weekend of archaeology. Operations hours are one of the biggest hidden costs of self-hosting, and standardization removes most of them.

And nothing sits stranded. We fill racks properly and share what was built to be shared: a switch port that would sit dark in your closet serves another workload here, so nobody is buying a 48-port switch to light up 12. Rack space, PDUs, UPS capacity, and cooling are bought once, at data-center rates, and spread across the platform instead of one three-host island. Hardware refreshes happen on our schedule at volume pricing, spares are stocked once for the fleet, and patching and host upgrades are simply our problem, not yours.

You get VMs and backups in a cloud-like format. We sweat the racks, power, cooling, refreshes, and upgrades behind them. Add up the idle redundancy you no longer buy, the ops hours you no longer burn, and the ports and racks you no longer strand, and hosted genuinely comes in under buying and self-hosting the gear.

08 — About "half the price"

I'll be straight about this number: it's our modeled TCO, not somebody's published study. For the typical three-host refresh scenario, the hosted model avoids the VVF subscription ($14K–$18K a year), avoids the refresh capex (three servers at 2026 prices plus the switch refresh that usually rides along), and avoids the idle N+1 host, power, cooling, UPS maintenance, and staff hours that on-prem quietly consumes. Run over a five-year horizon against a monthly hosted plan, most of the models we build land at or below half the all-in cost of staying on-prem with VMware.

There's precedent at much larger scale for the underlying idea: that predictable workloads on the right platform beat sticker assumptions. 37signals famously moved off the public cloud, bought its own storage for a fraction of its annual S3 bill, and reported cutting its overall cloud spend from over $3 million a year to well under $1 million. The direction of the math holds at three hosts too; it just points toward a shared platform instead of your own racks.

09 — Bring us your quote: free 3-host TCO teardown

If your VMware renewal or hardware refresh is on the table this year, don't sign it on autopilot. Send us the quote and we'll model your current licensing and refresh costs, line by line, against a hosted IaaS/DRaaS/BaaS plan on our platform.

Request a 3-Host TCO Teardown →

You'll talk to the engineer who would actually run your environment.

Originally published at modernops.com.

Disclosure: I work for ModernOps, and sections 06-09 describe our own hosted platform and services. The market figures in sections 01-05 are drawn from public reporting; run them against your own quotes.