When we speak of the protection of data, many organizations feel peace of mind knowing that you are backed up. However, before an attack of ransomware, the backups are also in the crosshairs.

According to a study by Sophos, 94 % of the organizations that are affected by this type of malware claimed that the attackers attempted to compromise your backups, and 57 % of these attempts was successful.

Modern attacks are not limited to encrypt servers or workstations. In reality, seek to compromise the entire environment, including the mechanisms of support, to prevent the recovery of information and increase the pressure on the company.

So, rather than ask ourselves if we have backups, we must ask ourselves whether we can really use them when we need them.

The problem is not to lose data, but the ability to recover them

In many safety incidents, the most significant impact does not come from the first attack, but the inability to quickly restore the affected services.

Imagine that an attacker obtains privileged access to your technological environment. After compromising critical systems, encrypted servers, databases and business applications.

Up here, if you think that your backups are sufficient to retrieve the information.

However, during the investigation you find out that the attacker was also able to access the repositories and backup deleted or encrypted part of the available copies.

At that time, having a backup is not enough. The real challenge is to find a copy reliable and recover systems in the shortest possible time.

An effective support goes far beyond saving information

A strategy of a modern protection must provide for mechanisms to protect the backups and ensure that they can be used when it is necessary, in the shortest possible time.

Copies isolated and protected

If the backups are accessible from the same compromised systems, there is the possibility to also be deleted or encrypted.

For this reason, it is recommended to implement isolation schemes logical or physical, combined with technologies of immutability that prevent the modification of the backup during a given period.

The goal is to always keep available a copy reliable to retrieve the information.

Periodic testing of restoration

One of the most common mistakes is to assume that a backup will work properly when needed.

The only way to validate a schema backup is performing restorations and regular checking that the recovered data are complete, consistent, and usable.

If a backup has never been tested, it is not a guarantee; it is an expectation.

What you should recover first if it all stops?

Not all systems have the same level of criticality.

An application of internal support can tolerate several hours of downtime, whereas a transactional platform or a production system may require recovery time much smaller.

That is why it is important to define clear objectives:

• How long can you stay out-of-service application?
• What amount of information can be lost without affecting the business?
• What systems must be recovered first?

Answering these questions allows the design of strategies support aligned with the real needs of the organization.

What if someone tries to alter or delete any of your backups?

The current threats are not only seeking access to the information; they also attempt to tamper with evidence, erase records and compromise recovery mechanisms.

For this reason, modern solutions backup feature controls such as:

• Immutability of data.
• Encryption of backups.
• Granular Control of access.
• Multifactor authentication.
• Monitoring of suspicious changes.
• Alert to attempts at deletion, or modification.

in front of accesses and unauthorized modifications, reducing the risk of an incident also compromise the ability of recovery.

Are you sure that your plan would work under pressure?

Having a recovery strategy can build trust, but that trust does not always reflect the actual capacity of re-operate after an incident. A study of Veeam 2026 found that 90 % of the perpetrators he hoped to recover from an attack, but among those who suffered ransomware, only 28 % was able to completely recover all the data involved.

The difference is in having tested the recovery before it is needed. A plan can be seen in full on the paper, but it is during a contingency when it actually shows if the backups, processes, and decision makers are prepared to work together.

The resilience digital as a goal

The growth of the attacks of ransomware, operational errors and internal threats has shown that the protection of data can no longer rely solely on store copies of information.

The resilience digital involves the ability to withstand incidents, to recover from them and re-operate with the least possible impact.

In this context, backups are only a part of the equation.

An effective plan should include the order of restoration, dependencies between applications, responsible for implementation and validation procedures.

During a contingency, every minute counts. If there is not a defined strategy, the recovery times can be extended considerably, even when the backups are available.

Therefore, the disaster recovery must be addressed as an integral process and not only as a technological function.

Does your organization have recently tested how long it would take to recover your critical systems after a security incident?