Attackers know that a clean backup is your way out, so they look for backups before they encrypt anything. If any of these sound familiar, your recovery plan may fail when you need it most.
- Backups use the same administrator accounts as your servers. One stolen password reaches both.
- Nothing is immutable. Backup copies can be changed or deleted from the network.
- There is no offline or off-site copy. Everything sits on the same network as production.
- Restores are never tested. Backups “complete successfully” but nobody has restored from them this year.
- Nobody watches backup alerts. Failed or deleted jobs go unnoticed for weeks.
- Cloud and SaaS data are not covered. Microsoft 365 mailboxes and files are assumed to be safe by default.
A simple rule to aim for
Keep at least three copies of important data, on two different types of storage, with one copy off-site and one copy immutable or offline, and verify that restores work.
Take our 2-minute cyber self-check to see where you stand.