World Backup Day: The New Reality of Data Resilience

Ransomware has evolved; attackers now hunt for backup systems before launching the main strike. They slip into an environment, corrupt the recovery chain, then trigger the payload when escape routes are already gone. AI is only accelerating this shift, giving attackers tools to scan networks and breach defences at scale. Backups alone no longer guarantee a way out, so organisations need to ensure recovery is fast, predictable, and resilient – even when data protection layers are compromised.

Yet, many still depend on processes built for accidental loss or hardware faults. Without modern resilience, recovery times lengthen while costs skyrocket, leaving the true level of risk remaining hidden. So, what can organisations do to mitigate this?

Making data protection a strategic investment

With cyber threats constantly changing, data protection technologies need to keep up the pace. Today’s attackers often spend weeks, or even months, inside corporate networks before launching attacks. This quiet corruption of systems and data can be catastrophic, leaving organisations in the dark on which data can actually be trusted and whether backups have also been compromised without them knowing.

This is an issue highlighted by Mark Molyneux, Field CTO at Commvault; “This challenge is becoming even more critical as businesses adopt technologies like AI, where decisions and operations rely on vast volumes of constantly changing data. If the underlying data is corrupted or poisoned, the consequences can spread rapidly across systems and outputs. Trusted backups are not just a recovery tool – they are a foundation for operational resilience”.

Molyneux continues: “Simply restoring data without verifying its integrity risks reintroducing the same threats that caused the incident in the first place. Backups remain one of the most important safeguards organisations have. Organisations that invest in validating and protecting their backups today will be far better prepared to recover quickly and confidently when disruption inevitably occurs”.

Modernising recovery strategies

As environments are becoming more distributed, recovery expectations are changing. “In the past, backup strategies were built around centralised systems and assumed that data could be restored back into the same environment”, says Mark Christie, Senior Director, Technical Services at StorMagic. “That assumption doesn’t always hold anymore”.

Christie argues that the question is no longer just where data is backed up, but how quickly systems can be brought back online locally; “If recovery depends on pulling large volumes of data from a central location, that can introduce delays at exactly the moment uptime matters most. As a result, more teams are looking at backup and recovery together rather than as separate processes. That includes keeping recent copies of data closer to where it’s used, validating recovery workflows across sites, and making sure critical applications can continue running even if the primary environment is unavailable”.

He emphasises that organisations must realise the importance of whether operations can continue running even when something goes wrong; just having a basic copy of the data is not enough to ensure this.

Strengthening protection with managed service providers

Although backups have long been a foundation of effective cyber resilience strategies, their management is much more complex now than it ever has been before, as recognised by Stephan Badesha, CISO at Node4: “This requires continuous oversight and specialist expertise that in-house teams may not always have the capacity to provide. As a result, many organisations turn to managed service providers (MSPs) to deploy and manage their backup solutions. These services are often complemented by security operations centres (SOCs), which provide continuous threat monitoring and incident response across IT environments, including backup infrastructure”.

Badesha furthers: “No backup strategy is complete without a strong recovery plan. Backups have limited value if they cannot be restored quickly and effectively when needed. MSPs can provide the technical expertise to design structured, easy-to-follow backup and recovery plans, supported by regular testing. These plans determine appropriate storage locations based on recovery objectives, sensitivity, and risk profiles. Regular testing will enable organisations to confirm that systems remain operational and provides practical experience of the recovery process, so when the time comes, teams are confident about what they need to do. Ultimately, a backup strategy is only as strong as its ability to perform under pressure”.

Consolidating backups in cloud environments

Having witnessed or experienced the swathe of recent high-profile cyber outages and attacks, organisations now need to look at what can be learned to mitigate such impact in the future. Terry Storrar, Managing Director, Leaseweb UK, states that reliable access, performance and protection of mission critical data can never be taken for granted, especially in cloud environments.

“Resilience is now just as important as performance and scalability”, says Storrar. “Cloud platforms provide highly available environments for running applications and storing data. However, backup and recovery strategies remain a shared responsibility between providers and customers. As such, hosting data in the cloud does by no means automatically guarantee it is protected from accidental deletion, misconfiguration or malicious attacks”.

He adds: “That’s why robust backup strategies remain a critical part of modern cloud architecture. It is very common for organisations to adopt layered approaches combining secure cloud-based backups with immutable storage and offline copies. Integrating a combination of different security measures ensures that even if production environments are disrupted, data can be restored quickly with minimal downtime and impact on operations. For organisations running critical workloads in the cloud, backups should never be an afterthought”.

Clearly, backup and recovery strategies are not a one-size-fits-all solution. Organisations must take the time to truly understand the potential threats they may face, and invest in thorough and tailored strategies to keep their data safe in the long run.