The SaaS Risk Zoo: Protecting Your Data from Every Creature in the Cloud
- David Long
- Aug 8
- 11 min read
Updated: Aug 11
By FullBackUp
In nature, survival belongs to the prepared. In business, it’s no different.
The threats to your SaaS data don’t come in a single shape or size. Some are rare and unpredictable. Others are marching toward you right now. A few are so obvious they’re like an elephant in the room - yet still ignored.
In the wild, we give them names: Swans. Rhinos. Elephants. Tigers. Creatures with distinct behaviours and ways of attacking. In the cloud, these same patterns exist - only now, the predators hunt your data.
Welcome to the SaaS Risk Zoo.
Let’s meet the animals.
Black Swan - The Outage You Never Saw Coming
They don’t happen often.
But when they do, they change everything.
July 19, 2024. One flawed CrowdStrike update takes down Microsoft Windows. Airports ground flights. Hospitals pause surgeries. Emergency services stall.
8.5 million systems crash worldwide. It becomes the largest IT outage in history.
And it wasn’t the first.
In 2023, Microsoft Exchange and Teams locked millions of users out for hours.
And it’s not just Microsoft.
Salesforce (Oct & Nov 2024): Two separate global outages freeze CRM access, halting sales pipelines in their tracks.
Heroku / Salesforce Cloud (June 2025): Authentication, deployments, and data syncs stop dead across thousands of dev teams.
Here’s the pattern:
When the platform goes down, you go down with it.
If your only copy of critical data lives inside that platform, your business is in the dark until they fix it.
The Keepit Advantage
What if outage recovery didn’t depend on the platform that just failed?
With Keepit, your SaaS backups live completely outside the provider’s cloud.
No shared infrastructure. No shared blast radius. No waiting.
Immutable & blockchain-verified – so your data can’t be tampered with or erased.
Always accessible – even if Microsoft, Salesforce, or Slack are offline.
Work without the platform – controlled, independent access lets your users keep working with their data while production systems recover.
From days of downtime… to minutes of productivity.
Black Elephant - The Catastrophic Risk Hiding in Plain Sight
It’s not rare.
It’s not unpredictable.
It’s glaringly obvious - and too many are ignoring it.
Known retention gaps remain unaddressed.
No backup for Entra ID - the keys to your kingdom - left dangerously exposed.
Ignored audit findings quietly accumulate, until they erupt into disaster.
When failure strikes, there’s no mystery - and no excuse can restore what’s gone.
Real-World Example: The Adesys Incident
A Wisconsin-based MSP, Adesys, discovered just how fragile Entra ID security can be when one compromised global admin account triggered 1,800 unauthorized changes across their clients' identity configurations. Without a working backup, recovery became a manual, days‑long process fraught with risk:
Logs helped identify the changes - but couldn’t undo deletions or restore critical configurations.
Without backups, everything had to be manually rebuilt.
As one MSP lead put it:
“Entra ID has great logging, but logs don’t let you undo actions like deleting machines or restoring critical configurations. Without a proper backup, there’s no way to get that back.
The Keepit Advantage
Stop the disaster before it starts.
Deploy in minutes, not days weeks - from zero to protected, fast.
Retention enforced indefinitely – compliance and visibility without constant admin effort.
No more “we’ll get to it later” - that outdated excuse disappears, along with the risk.
Some disasters don’t lurk unseen- they’re waiting in the blind spot.
Red Swan - The Attack That Changes Everything
It’s not an accident.
It’s not bad luck.
It’s a deliberate strike.
Ransomware.
Insider threats.
Calculated, malicious destruction.
Today’s attackers don’t stop at production data — they go straight for your backups. One compromised identity can wipe out both, leaving you with nothing to restore.
The Keepit Advantage
Built to withstand the very attack designed to destroy it.
Immutable by design - backups can’t be altered, encrypted, or deleted - even by a compromised admin.
Off-cloud, out-of-band storage - completely isolated from production networks.
Invisible to attackers - no path, no lateral movement, no access.
When the Red Swan arrives, you don’t pay a ransom. You get your data back.
Yellow Swan – The Warning Was There
It wasn’t random.
It wasn’t unpredictable.
You saw it coming - and still, it happened.
Admin accounts without MFA left wide open.
Retention policies set to expire with no safety net.
Audit findings and security alerts… ignored.
The pattern was clear. The fix was simple. But action came too late.
The Keepit Advantage
Even when prevention fails, recovery doesn’t have to.
Clean, independent restore points for every SaaS workload.
Completely isolated from the source platform - no reliance on upstream hygiene or security settings.
Always ready to recover - regardless of whether the warnings were acted on.
Because the only thing worse than seeing it coming… is not being able to come back from it.
Black Tiger – The Predator in Your Network
Fast.
Targeted.
Unforgiving.
Some threats don’t burst through the door. They stalk quietly, hidden in your systems for months. Mapping your network. Learning your habits. Waiting for the perfect moment to strike.
By the time they make a move, they’ve already cut off your recovery paths. The backups you thought would save you? Gone, corrupted, or quietly sabotaged.
Real-World Example: The KNP Logistics Collapse
In 2023, UK freight giant KNP Logistics fell victim to exactly this kind of predator. Attackers gained access via a single compromised account, moved silently through the network, and deleted backup data long before the ransom demand appeared. With no clean recovery path, operations halted. Within weeks, the 158-year-old company shut its doors, putting 700 employees out of work.
The Keepit Advantage
Your vault stays out of reach - even if the predator roams free inside your network.
Physically and logically separated from the live environment.
Independent infrastructure - no shared systems, no shared blast radius.
Immune to lateral movement - attackers can’t find it, can’t touch it, can’t kill it.
When the predator is already inside, survival depends on the vault it can’t reach.
Pink Swan – Thinking You’re Covered? Think Again
It’s the assumption that catches everyone.
“Microsoft’s got it.” “Google’s got it.”
They do — for uptime.
Not for your data.
Most organisations only discover the truth after their first major loss: deleted emails, overwritten files, expired retention… gone forever.
Real-World Example: The NHS Trust Data Loss
In 2022, an NHS Trust in the UK permanently lost over 150,000 patient records when staff emails were deleted after Microsoft 365’s retention window expired. The trust assumed Microsoft had a full backup. They didn’t - and there was no way to recover the lost data. The incident triggered public criticism, compliance scrutiny, and costly remediation work.
The Keepit Advantage
When the platform’s promise ends, Keepit’s protection begins.
Full coverage across Microsoft 365, Entra ID, Google Workspace, and more.
Granular recovery - right down to the individual email, file, or Teams chat.
Restore in seconds - exactly as it was before deletion, overwrite, or expiry.
Because assuming you’re covered… is the easiest way to find out you’re not.
White Swan - You Know This Will Happen
It’s not rare.
It’s not unpredictable.
It’s guaranteed.
The wrong file deleted.
A critical document overwritten.
Retention quietly expiring before anyone notices.
It’s not if - it’s when.
Real-World Example: Pixar’s Toy Story 2 Near-Loss
During production of Toy Story 2, an animator accidentally ran a deletion command that began wiping key movie files. Backups were outdated. Without an offsite copy saved by chance on a director’s personal machine, months of work - and millions of dollars - would have been lost. It’s a perfect example: accidental deletions happen, and without point-in-time recovery, there’s no going back.
The Keepit Advantage
Because some mistakes should be a quick fix - not a career-ending disaster.
Point-in-time restores for any object - from a single email to an entire tenant.
No partial recoveries - everything restored exactly as it was.
No “it’s gone” - if it existed, you can bring it back.
When the inevitable happens, Keepit makes it instantly reversible.
Grey Swan – We Knew It Could Happen
Everyone knew it was possible.
No one knew when.
Known, rare risks with unpredictable timing - from regional outages to critical feature failures. They appear without warning, stall productivity, and remind you how fragile “always on” really is.
Real-World Example: Microsoft MFA Outage 2019
In November 2019, a misconfiguration in Azure Active Directory caused a global multi-factor authentication outage. Millions of Microsoft 365 users were locked out of email, Teams, and cloud applications for hours. It wasn’t a breach - just a known risk that became reality without warning, grinding work to a halt.
The Keepit Advantage
Because “we knew it could happen” is not a recovery plan.
Backups stored outside your SaaS vendor’s environment - no shared systems, no shared outage.
Guaranteed availability - even when the primary service stumbles.
Instant, direct restores - completely under your control.
When the Grey Swan lands, you don’t wait - you recover.
Green Swan – The Crisis Hidden in Climate
It doesn’t matter how advanced your technology is - nature always plays the last card.
Floods.
Fires.
Power failures.
When physical events cripple infrastructure, “cloud” doesn’t mean “invincible.” Lose access to the internet, and your business can be just as paralysed as if the servers were underwater.
Real-World Example: The 2022 Eastern Australia Floods
Historic flooding in Queensland and New South Wales knocked out data centres, severed fibre links, and left thousands of businesses without access to critical systems -including cloud platforms. Entire towns were offline for days, and those without geographically redundant, independently accessible backups had no way to recover or operate.
The Keepit Advantage
Because the cloud is only useful if you can reach it.
Redundant, climate-secure storage across geographically diverse regions.
Independent access paths - ensuring you can reach your data even if your provider’s region is down.
Operational continuity - keep working, even when an entire area is offline.
When nature takes out the grid, Keepit keeps you connected.
Black Jellyfish – The Threat You Don’t See Coming
Invisible.
Drifting.
Deadly.
Some breaches don’t strike fast - they wait.
They move quietly through your systems, mapping every path, corrupting what they touch, and compromising your backups long before you ever know they’re there.
By the time you detect them, they’ve been in place for months - and the damage is already done.
Real-World Example: SolarWinds Supply Chain Attack
In 2020, attackers compromised SolarWinds’ Orion software, distributing malicious updates to 18,000 organisations, including government agencies and Fortune 500 companies. The intrusion went undetected for up to nine months. During that time, attackers had access to credentials, systems, and potentially backup environments - giving them the ability to silently weaken or sabotage recovery options before discovery.
The Keepit Advantage
Because sometimes the first day you notice a breach isn’t the first day it happened.
Immutable, versioned backups - recover to a clean point before the breach began, even months back.
Air-gapped architecture - backups are untouchable from the production environment.
Independent retention control - keep historical versions as long as you need, outside the attacker’s reach.
When the jellyfish drifts into view, it’s already too late to stop it - unless your backups were never in its path.
Grey Goose – The Unwelcome Visitor from Afar
It starts oceans away.
You think you’re out of reach.
You’re not.
Global risks have a way of crossing borders at the speed of a login. When a cyber incident spreads internationally, distance offers no defence - just a delay.
Real-World Example: NotPetya 2017
In June 2017, the NotPetya malware outbreak began in Ukraine but spread across the globe within hours. Maersk, FedEx’s TNT Express, and dozens of other multinationals saw their operations crippled. Maersk had to rebuild 45,000 PCs and 4,000 servers in ten days - only possible because a single untouched domain controller in Ghana escaped the attack. For many others, backups tied to compromised identities were also destroyed.
The Keepit Advantage
When the threat comes from afar, you need a vault it can’t reach.
Isolates SaaS backups from production identity - compromised accounts can’t access or alter them.
Clean, untouchable restore points - even in a mass-compromise scenario.
Independent access control - recovery stays in your hands, not the attacker’s.
Why Keepit is Different
Most SaaS backup vendors store recovery data on the same hyperscaler cloud as your production environment - creating shared risks: jurisdictional exposure, single points of failure, and insider compromise.
Keepit takes a different path:
Full tech stack ownership - hardware and software, no hyperscaler dependency.
Regional sovereignty - you choose your data’s home, and it never leaves.
Jurisdictional protection - outside U.S. regions, the CLOUD Act does not apply to your data.
Complete separation - backups physically and logically isolated from production.
Encryption end-to-end - AES at rest, TLS in transit, keys held only by Keepit.
Because geography doesn’t stop cyber risk - architecture does.
Dragon King – The Outlier That Resets the Rules
Bigger.
Rarer.
More destructive.
A Dragon King isn’t just an outlier - it’s an event so extreme it forces the entire industry to rewrite the rules.
In cybersecurity, that could be:
A cascading multi-cloud outage.
A supply chain exploit affecting every major SaaS platform simultaneously.
A hyper-scale ransomware attack hitting multiple providers at once.
These don’t just cause downtime - they reset the definition of resilience.
Real-World Example: The CrowdStrike Update Meltdown (2024)
On July 19, 2024, a faulty CrowdStrike update bricked 8.5 million Windows systems worldwide. Airports, hospitals, emergency services, and financial institutions ground to a halt. Microsoft 365, Azure, and countless dependent SaaS platforms went dark.This wasn’t a single cloud vendor outage - it was a global dependency failure that exposed how quickly one flaw can cascade across every corner of the digital ecosystem.
The Keepit Advantage
When the unthinkable becomes reality, your backups can’t share the same blast radius.
Isolated from platform-wide collapse - no shared infrastructure with the SaaS providers you protect.
Full technology stack ownership - hardware and software under Keepit’s direct control.
Jurisdictional independence - data stays in your chosen region, outside the reach of foreign laws like the CLOUD Act.
Physically separate storage - even if multiple providers are compromised, your backups remain intact and accessible.
Because when the Dragon King appears, survival depends on standing outside its reach.
Blue Swan – The Opportunity You Can See Coming
Not every Swan signals disaster. A Blue Swan is the rare event you can predict - and prepare for - to turn a looming risk into a competitive advantage.
In the world of SaaS resilience, that might be:
A known compliance deadline bringing new regulatory demands.
A planned SaaS migration that could disrupt access to business-critical data.
A major vendor sunsetting a feature your workflows rely on.
These events don’t need to cause chaos - if you’re ready.
The Keepit Advantage
Blue Swans reward preparation.
Pre-migration protection - safeguard every object before moving platforms.
Regulatory readiness - meet new compliance standards without last-minute scrambles.
Feature retirement insurance - preserve and access data even after a vendor changes direction.
With Keepit, the Blue Swan becomes a moment to strengthen resilience - not test it.
Final Word: Surviving the SaaS Risk Zoo
From the sudden strike of the Black Swan, to the obvious but ignored Black Elephant, to the industry-shaking Dragon King, every creature in the SaaS Risk Zoo comes with its own threat pattern. Some arrive without warning. Others walk toward you in plain sight. A few, like the Blue Swan, give you the chance to prepare and win.
The lesson is simple:
Resilience isn’t an accident. It’s engineered.
Keepit keeps your SaaS backups isolated, immutable, and instantly recoverable - no matter which animal appears at your door.
Because in the Risk Zoo, the survivors aren’t the strongest or the fastest. They’re the most prepared.
Ready to see how your SaaS resilience stacks up?Don’t wait for the next Swan, Elephant, or Tiger to appear. Book a quick, no-obligation resilience review and find out exactly where you stand - and how Keepit can protect you from every predator in the Risk Zoo.
A lot of swans!
I’d only heard of black swans… now I’m not sure if I should be impressed or mildly terrified.