Ask HN: Guarding against a "trickle delete" or otherwise unnoticed attack?

How realistic is it to protect against an attack where someone retains access to your system for an extended period of time and therefore can cause minor incremental damage that could exceed backup image retention? (ie. 30 days?)