Only to the degree that attackers can't figure out a way around them (given months of planning with access to internal systems & documentation). For instance:

Only to the degree that attackers can't figure out a way around them (given months of planning with access to internal systems & documentation). For instance: I have backups going to an append-only s3 bucket in a separate AWS account, but I don't have monitoring in place to ensure that bucket hasn't been wiped. An email would get generated, but it'd go to the root account holder, who may not notice in time.