You Have Backups. Can You Actually Recover? Most Organisations Cannot.

Most organisations believe they can recover from a ransomware attack because they have backups. The uncomfortable reality is that having backups and being able to recover are two very different things, and the gap between them is where ransomware does its worst damage. Industry research in 2026 found that while almost all executives were confident in their recovery capability, a majority had suffered multiple recovery failures in the past year, largely because they estimated their recovery ability from guesswork rather than testing (reporting). Backup is the easy part. Recovery is the problem.

Backups fail more often than leaders think

The first hard truth is that backups frequently do not restore when it matters. A large share of backups fail during the actual recovery process, and most organisations that genuinely test their backups discover failures they did not know about (analysis). A backup that completed successfully is not the same as a backup that will restore successfully, and the difference only surfaces under the pressure of a real incident unless you have tested it beforehand.

This is why executive confidence is so misleading. When recovery time is estimated rather than measured, the estimate is almost always optimistic. The organisation plans around a recovery it has never actually performed, and finds out the truth at the worst possible moment.

Attackers are hunting your backups

The second hard truth is that ransomware operators have adapted specifically to defeat backups. They understand that backups are what let a victim refuse to pay, so they go after them deliberately. In Sophos’s analysis of ransomware incidents, attackers attempted to compromise backups in the large majority of cases and succeeded in more than half, usually by reaching backup data through the same credentials that compromised the production environment (Sophos analysis).

Modern attackers do not encrypt the moment they get in. They spend days inside the network, locating backup systems and quietly tampering with or deleting backup chains, before triggering encryption. By the time the ransomware fires, the restore point the organisation is counting on may already be corrupted or gone.

The attacker’s goal is not just to encrypt your data. It is to make sure that when you reach for your backups, there is nothing clean left to reach for.

The real challenge: finding a clean recovery point

This changes what recovery actually involves. The task is no longer simply to restore the most recent backup. It is to identify a recovery point that is genuinely clean, from before the attacker began tampering, and restore from that without reintroducing the compromise. Restoring the latest backup may just restore the infection.

That is a far harder problem, and most disaster recovery plans were never designed for it. They assume accidental failure, a hardware fault or a data centre outage, where the newest backup is the best one. Against ransomware, the newest backup is often the most suspect, and recovery requires the ability to determine what is clean.

What recovery readiness actually requires

Being genuinely able to recover, rather than merely having backups, comes down to a few disciplines that the ransomware era has made non-negotiable:

• Immutable or offline copies. At least one backup copy must be immutable or air-gapped, so attackers who compromise production cannot alter or delete it. This is the core of the updated 3-2-1-1-0 approach: the added copy is immutable, and the zero means zero verified errors.
• Separation from production credentials. Backup systems must not be reachable with the same credentials that run production, because that is precisely how attackers get to them.
• The ability to find a clean recovery point. You need to be able to identify and validate an uncompromised restore point, not just grab the latest.
• Tested recovery, not assumed recovery. Recovery must be rehearsed end to end, including clean point identification, with the real recovery time measured rather than guessed.

None of this is exotic, but it requires treating recovery as a capability to be built and proven, not a checkbox satisfied by the existence of backups.

What technology leaders should do

1. Test a full recovery, honestly. Run a realistic exercise that includes identifying a clean recovery point, and measure how long restoring critical systems actually takes.
2. Protect your backups as a target. Ensure at least one immutable or offline copy, and make sure backups cannot be reached with production credentials.
3. Define real recovery objectives. Base them on tested reality, not optimistic assumption, and close the gap where recovery is slower than the business can tolerate.
4. Rehearse regularly. Threats and systems change, so a recovery test is only valid for the environment that existed when it was run.

The organisations that come through a ransomware attack intact are not the ones with the most backups. They are the ones that proved, in advance, that they could actually recover.

Where Jaykan fits

Jaykan helps enterprises and government organisations build genuine recovery readiness, from immutable backup architecture and credential separation to tested, measured recovery of critical systems, as part of our IT services and resilience practice. We help clients replace the false confidence of having backups with the real confidence of a recovery they have proven works.

If you have never fully tested whether you could recover from a ransomware attack, a complimentary, senior led assessment will show you where your recovery would fail and how to fix it before you need it.

Frequently asked questions

Isn't having backups enough to recover from ransomware?

No. Backups are necessary but not sufficient. Many backups fail during the actual restore, attackers increasingly compromise backups before triggering encryption, and the latest backup may itself be infected. Recovery depends on having clean, protected copies and a tested process to restore them, not just on backups existing.

Why do attackers target backups?

Because backups are the thing that lets a victim refuse to pay. Modern ransomware operators spend days inside a network locating and tampering with backups before encrypting production, often using the same credentials that compromised the main environment, so the victim discovers their recovery option is gone exactly when they need it.

What is the 3-2-1-1-0 backup rule?

It is an update to the classic 3-2-1 rule (three copies, two media, one offsite) for the ransomware era. The added 1 is one immutable or offline copy that attackers cannot alter, and the 0 is zero verified errors, meaning backups are tested and proven restorable rather than assumed to work.

How do we know if we can actually recover?

Test it. Run a realistic recovery exercise that includes identifying a clean recovery point, not just restoring the latest backup, and measure how long full recovery of critical systems actually takes. Confidence based on guesswork is the main reason organisations discover recovery failures during a real incident.