Ransomware gangs have one business model: make your data unavailable and sell it back to you. The single best way to ruin that model is to not need them.
This is not a rare problem. Verizon’s 2026 Data Breach Investigations Report found ransomware involved in 48% of the breaches it analyzed, up from 44% the year before. The same report found that 69% of ransomware victims did not pay. For most organizations that can say no, the reason is simple: they had a way to recover without the criminals.
Prevention matters: patching, multifactor authentication, email filtering and staff awareness all reduce the odds of an attack. But no defense is perfect. When prevention fails, one thing decides whether you are back in business in a day or negotiating with criminals: a backup you can actually restore from.
The deciding factor
Why ordinary backups are not enough
Modern ransomware does not just encrypt your files. Attackers often spend days inside a network first, looking for backups so they can delete or encrypt those too. A USB drive that is always plugged in, a backup folder on the same server or a sync service that faithfully copies encrypted files are all at risk.
Think about what an attacker sees once they are inside. If your backup server is joined to the same Windows domain as everything else, the domain admin password they just stole opens it too. If the backup console can be reached from any workstation, they can log in and delete restore points before they launch the encryption. Many ransomware crews do exactly this, on purpose, because they know a company with clean backups does not pay.
A backup you have never tested is a hope, not a plan.
What “good” looks like
A widely used guideline is the 3-2-1 rule: keep three copies of important data, on two different types of storage, with one copy off-site. Today many IT pros add a fourth element: at least one copy that is immutable or offline, meaning it cannot be changed or deleted from your network, even by an administrator account, for a set period.
- Separate credentials: Backup systems should not use the same admin accounts as everything else, and they should have MFA of their own.
- Immutable or air-gapped copy: Cloud backup with object lock, or media that is physically disconnected.
- Cover cloud apps too: Microsoft 365 and Google Workspace data needs its own backup; built-in retention is not the same thing.
- Know your recovery time: How long would it take to restore everything? Hours, days or weeks?
- Test restores regularly: Recover real files and at least one full system on a schedule, and write down what you learn.
Bottom line: The goal is not just to have backups. The goal is to be able to say, with confidence, “we can restore our critical systems by this time tomorrow.”
A realistic scenario
Two companies, same attack
Picture two small firms hit by the same ransomware strain on a Monday morning. Both lose every server and every laptop with a mapped drive.
The first kept its backups on a network storage box in the server closet, joined to the domain and running nightly. The attackers found it on the second day of their visit and encrypted it along with everything else. That firm is now choosing between paying, rebuilding from scratch, or both, and paying does not guarantee a working decryptor.
The second ran the same nightly backup plus an immutable cloud copy with a 30-day lock, managed under separate credentials. The attackers deleted what they could reach and could not touch the rest. That firm has a long, annoying day of restores and is billing clients again by Wednesday. Same attack, very different outcome. The difference was a modest yearly storage bill and a restore test someone actually ran.
A restore test you can run this month
- Pick your targets: One critical file share and one critical server or virtual machine.
- Restore files somewhere safe: Recover the share to an alternate location and open a sample of files from different folders and dates.
- Boot the server: Restore it to an isolated network or test host, start it up and confirm the application actually works, not just that the job said “success.”
- Time it: That number is your real recovery time, not the one on the product page.
- Write it down: Note what broke, fix it and put the next test on the calendar. Quarterly is a sensible starting point.
If you use Microsoft 365, add one more step: restore a deleted mailbox folder or a OneDrive file from your backup tool. Plenty of businesses find out during an incident that Microsoft was not backing up their data the way they assumed.
Do not skip the rest
Backups give you a way out, but they do not stop attackers from stealing data and threatening to publish it, which many gangs now do. Keep layering defenses: patch quickly, require multifactor authentication, limit admin rights and monitor for unusual activity. For a complete checklist, CISA’s free #StopRansomware Guide is the best place to start. It specifically calls for offline, encrypted backups that are tested regularly.
Most ransomware still gets in through an inbox, so it is worth learning how to spot a phishing email in under 30 seconds. And if you think your business is too small to be a target, read the dumbest assumption small businesses make about hackers. Then test your backups again. It is the cheapest insurance you will ever buy.
Leave a Reply