Is LTO-9 Tape Backup Still Worth It Against Ransomware in 2026?

Tape has been declared dead for decades, and it keeps outliving the predictions for one reason: a cartridge sitting on a shelf is the simplest copy of your data that nothing on the network can touch. Ransomware has made that property more valuable, not less. The question for 2026 is not whether tape still works, but whether your data volume and retention needs justify running it. Here is how to decide, how tape actually defends against ransomware, and what to buy.

Is tape backup still worth it in 2026?

For many mid-size and large environments, yes. LTO-9 stores 18TB native per cartridge, cartridges use no power once they are on a shelf, and the media is rated for decades of archival life: the IBM LTO-9 Ultrium 18TB cartridge, like the HPE and Quantum LTO-9 18TB cartridges we list, is rated for up to 30 years under specified storage conditions. That combination suits large backup sets and long retention better than keeping ever more spinning disk online.

• Tape is worth it when you protect tens of terabytes or more, keep backups for years (legal, financial, healthcare or research retention), need an offline copy for cyber-insurance or audit requirements, or archive data you rarely read.
• Tape is harder to justify when the whole data set is a few terabytes, when nobody will own the tape rotation, or when every restore must be fast. In those cases immutable disk or object storage copies are often simpler.
• Most organizations use both: disk for fast day-to-day restores, tape as the offline last line of defense.

How does LTO tape protect against ransomware?

Ransomware encrypts or deletes what it can reach. Attackers now routinely go after backup servers, snapshots and online backup repositories first, so that the victim has nothing to restore from. A tape cartridge that has been written, ejected and moved to a shelf or offsite vault has no network path at all. It cannot be encrypted, overwritten or deleted remotely, whatever credentials the attacker holds.

• Air gap: the protection comes from the cartridge being physically out of the drive. Tapes left sitting in library slots are still reachable by a compromised backup server, so export them to an offline vault or offsite store on a schedule.
• WORM media: write-once, read-many cartridges such as the HPE LTO-9 Ultrium 18TB WORM cannot be overwritten or erased once written, which protects retained copies even from insiders.
• Encryption: the HPE StoreEver LTO-9 Ultrium 45000 and IBM TS2290 LTO-9 drives both list AES 256-bit hardware encryption. That protects cartridges in transit or storage against theft, though key management then becomes part of your recovery plan.
• Separate credentials: run the backup and tape system under accounts that are not domain administrators, so compromising the main directory does not hand over the backups.

The common framework is 3-2-1-1-0: three copies of the data, on two types of media, one offsite, one offline or immutable, and zero errors after restore verification. Tape is the easiest way to satisfy the offline copy. Our guide to backup and disaster recovery for AI data applies the same framework to large training data sets.

The protection is the air gap, not the tape itself. A cartridge that never leaves the library is just another online target.

What do I need to buy for an LTO-9 backup setup?

• A tape drive. A half-height internal drive such as the HPE StoreEver LTO-9 Ultrium 45000 needs a 5.25-inch bay, which many current rack servers do not have. An external drive such as the IBM TS2290 LTO-9 (18TB native, 12Gb/s SAS, AES 256-bit encryption) connects to any server with an external SAS port. Autoloaders and libraries hold multiple cartridges and take library-specific drive modules.
• A host adapter. Standalone SAS tape drives connect to a SAS HBA, not a RAID controller; see RAID controllers and HBAs. Library drives are often Fibre Channel and need an FC HBA and fabric ports.
• Cartridges. Enough for your full rotation plus spares: we list LTO-9 18TB cartridges from IBM, HPE and Quantum, plus HPE LTO-9 WORM cartridges for any copy that must be immutable.
• A cleaning cartridge for routine drive maintenance, and barcode labels if you use an autoloader or library.
• Backup software that supports your drive model, LTO generation and, if needed, encryption key management and WORM media.
• An offsite plan: a secure location or vaulting service, a transport container and a written rotation schedule.

Should I buy a standalone drive, an autoloader or a library?

Choose by how many cartridges a full backup needs and who will change them. If a full backup fits on one or two cartridges and someone swaps tapes daily, a standalone drive is enough. Once a full backup spans several cartridges, an autoloader or library avoids overnight tape swaps and failed jobs. The LTO-9 options we list step up in size: the IBM TS2900 LTO-9 autoloader; the Overland-Tandberg NEOs T24 LTO-9 24-slot autoloader in SAS or FC versions; the 40-slot Overland-Tandberg NEOxl 40 LTO-9 library in SAS or FC; and the IBM TS4300 library, which supports LTO-7, LTO-8 and LTO-9. Library drives are specific to the library: the IBM LTO-9 half-height FC drive module (02JH835) and the full-height SAS module (02JH838) are built for the TS4300, and the Overland-Tandberg LTO-9 add-on drives (SAS or FC) are built for NEOs and NEOxl units. Order drive modules by library model, not by LTO generation alone.

How do I make sure tape restores actually work?

Test them. A backup that has never been restored is a hope, not a plan. Restore a sample of files from tape regularly, and a complete system at least once a year, so the team knows how long a real recovery takes and the runbook is current. Tape streams large sequential restores well but takes longer than disk to reach individual files, which is another reason to keep a disk copy for everyday restores and treat tape as the copy you rely on when everything else is compromised. Keep the encryption keys, backup catalog and software install media somewhere that survives the same attack.

Should I buy LTO-9 or LTO-8?

For a new installation with large data sets, LTO-9: 18TB native per cartridge means fewer cartridges to buy, label, move and store. LTO-8 still makes sense when you already run LTO-8 drives and media, or when the data set fits comfortably at 12TB native per cartridge. The Dell LTO-8 half-height SAS internal drive (R5GV9) and the HPE StoreEver LTO-8 Ultrium 30750 (12TB native, 30TB compressed at 2.5:1, 12Gb/s SAS) are examples. Mind the compatibility rule: LTO-9 drives read and write LTO-8 cartridges, and LTO-8 drives read and write LTO-7 cartridges, but neither goes back further than one generation.

What about my older tapes?

Keep a working drive for every generation you still need to restore. LTO-6 cartridges, for example, need an LTO-6 or LTO-7 drive, because LTO-8 and LTO-9 drives cannot read them. That is why sites with long retention often keep an LTO-7 drive such as the IBM TS2270 LTO-7 external drive (6TB native, 12Gb/s SAS) alongside a newer one, or migrate old archives forward before the last compatible drive is retired. LTO-9 also runs a one-time optimization step when a new cartridge is first loaded, so initialize new media before it is needed in a backup window.

Tape pricing is driven by the drive or library, the number of cartridges in the rotation, and connectivity (SAS versus Fibre Channel). Current pricing is on each product page. Send Nexus Compute your data volume, retention period and server model, and we will size the drive, media and HBA as one setup and quote within 48 business hours.