Backups without testing are not a strategy

Organizations simply check the 'backup box' and do not ask themselves the crucial question: does the recovery process actually work? A backup that has never been restored is not a plan. It is hope, and hope is not a strategy. The data tells the story: 76% of organizations take more than 100 days to fully recover from a data breach (source: IBM/Ponemon 2025), 60% of backups are incomplete, and recovery attempts fail in 50% of cases (source: Avast) and 87% of IT professionals experienced a SaaS data loss in the past year, with human errors being the main cause. On top of that: 72% of data loss in the cloud is caused by misconfigurations or user errors, not by external attacks.

The difference between surviving and disappearing

For SMEs, the consequences are often disastrous. According to the Ponemon Institute, 60% of companies close their doors within six months after a serious data loss due to an incident or cyberattack. In contrast, there is a strikingly positive picture: 96% of organizations with a backup AND a tested recovery plan survive cyberattacks. The difference lies not only in having backups, but in having and testing an effective recovery plan.

Many companies rely on cloud platforms like Microsoft 365 and Google Workspace, but underestimate their own role in it. The default retention policy settings are designed for service continuity, not for complete data protection. Governance, Risk, and Compliance (GRC) teams must actively assess these settings against laws and regulations and internal risks. Without deliberate configuration, organizations rely on default settings that were never intended as a complete backup strategy.

New threats target backups

The threat is also evolving rapidly. According to the M-Trends 2026 report from Mandiant, ransomware attackers are increasingly targeting backup systems first, making recovery impossible. The Data Breach Investigations Report 2025 from Verizon confirms this: 64% of victims refused to pay ransom precisely because their backup and recovery strategy was in order.

On World Backup Day today, I have a tip: not only make backups, but also restore them. Do it today and test if it really works. Know your actual recovery time and not the theoretical one on paper. And if your GRC team hasn't checked your cloud settings in a while, make that your priority today. Backups may not be 'sexy', but they make the difference between surviving and disappearing.

Rich Greene, SANS Senior Solutions Engineer.