Every business we audit has backups. It is on the checklist, someone bought the product, the dashboard is green.
Almost none of them have ever restored from one.
That distinction is the whole ballgame. A backup you have not restored from is not a backup — it is a belief about a backup, and beliefs do not bring the finance system up on a Tuesday morning.
The ten-minute test
You do not need a disaster recovery exercise to find this out. You need one afternoon and the nerve to ask:
- Pick one system that would genuinely hurt to lose. Not the file share — the one that stops invoicing.
- Restore it. To a scratch environment, from the most recent backup, without asking the vendor for help.
- Time it. Write the number down.
- Open the restored system and check that the data inside it is actually the data from yesterday, not from the last time the job silently succeeded while backing up nothing.
If step 2 cannot be done by the people who work there today, using the documentation that exists today, you do not have a recovery capability. You have a licence.
The four failure modes we find most often
The job that stopped. It ran nightly for three years and then failed in March, and the alert went to an address belonging to someone who left in February. The dashboard is still green because nobody looks at the dashboard.
The backup the attacker can reach. Ransomware does not politely skip the network share your backups are on. If the same admin credential that runs your servers can also delete your backups, you have one copy of your data with extra steps.
The restore nobody has ever timed. Yes, you can recover. It takes eleven hours. Nobody knew that until the day it mattered, and the business had planned around "we'll be back by lunchtime."
The backup of the wrong thing. The virtual machine is backed up beautifully. The database inside it was mid-write when the snapshot was taken, so it restores into a state the database engine will not open.
What good looks like
More than one copy, in more than one place, at least one of which the day-to-day admin account cannot delete. Restores tested on a schedule — quarterly is enough for most businesses — with the result written down and sent to someone who is not the person who ran the test. And a known number for how long a full recovery takes, so the business can plan around a real figure instead of an optimistic one.
That is it. It is not expensive and it is not clever. It just has to actually be done.
Where this comes from
We run our own hosting platform, which means we have a commercial incentive to say our backups are excellent, and an operational reality where we get paged if they are not. That combination is a good teacher.
If nobody at your business can answer when did we last restore from a backup, and how long did it take — that is the thing to fix this month. Ask us for an audit and we will tell you which of the four you have.