Ask almost any business owner whether they have backups, and they’ll say yes without hesitating. Ninety two percent of organizations make that same claim, according to Kaseya’s research on backup reliability. The uncomfortable follow up question is different: have you actually tried to use them during a real incident? For 31 percent of organizations, the answer when ransomware actually hit was no, the backups didn’t work when it counted.
That gap between having a backup and having a tested one is where most disaster recovery plans quietly fail. It doesn’t show up on a dashboard. It shows up during the worst week of the year, which is exactly the wrong time to find out.
Most businesses are backing up and not checking
Separate research from Secureframe backs this up (no pun intended, though it’s a fair one): 62 percent of organizations don’t perform regular backup and restoration testing, and 71 percent do no failover testing at all to confirm their systems actually come back online the way they’re supposed to. Kaseya’s numbers point the same direction: more than half of businesses test their disaster recovery plan once a year or less, and a third test their backups infrequently or never.
Think about what that means in practice. A backup job can run successfully, every single night, for a year, and still fail completely the one time someone tries to restore from it: a corrupted file, a missed folder, a configuration that changed six months ago and nobody updated. Running the job isn’t the same as recovering the data, and the only way to know the difference is to actually test it.
What an untested backup actually costs
IBM’s 2025 Cost of a Data Breach report found that only 35 percent of organizations hit by an attack reported a full recovery, up from just 12 percent the year before (progress, but still a minority). The other 65 percent were still working through recovery when the survey closed. On the operational side, 10 percent of businesses lose a full workday or more before resuming normal operations after an outage, while only 2 percent can resolve an unplanned outage within 60 seconds. That’s the real spread between a business with a tested recovery plan and one running on hope.
The financial stakes for small businesses specifically are steep. Verizon’s 2025 Data Breach Investigations Report found that 19 percent of small and mid-sized businesses face bankruptcy following a cyberattack, and that number climbs fast when the recovery itself drags on for days instead of hours. A ransomware demand is a known cost. A failed recovery is an open-ended one.
What testing actually looks like
None of this requires a dramatic overhaul. It requires a schedule:
- Restore a sample of files on a regular cadence, not just when something breaks
- Run a full failover test at least annually so the team knows the process works under pressure, not just on paper
- Document recovery time for each critical system, so “how long will this take” has a real answer instead of a guess
This is the kind of ongoing discipline that proactive monitoring and maintenance work is built around at Cloud9 Tech Solutions: backups that are checked, not just scheduled, and a recovery process that’s been through a dry run before it’s ever needed for real. Automation handles the routine part. Someone still has to verify the result, which is the step most businesses skip.
If your last backup test was “we’re pretty sure it’s fine,” that’s worth revisiting before you need the answer under pressure. The businesses that test their recovery process ahead of time are the ones that treat a ransomware incident as a bad day instead of an existential one.
Ransomware Recovery Questions
How often should backups be tested?
Restore a sample of files on a regular schedule, with monthly being a sensible starting point for most small businesses, and run a full failover test at least once a year. A major system change is also a good reason to test again.
Why do backups fail during a ransomware attack?
The usual culprits are corrupted files, folders that were never included in the job, configuration changes nobody updated, and backups stored on the same network that got encrypted along with everything else. A nightly job that reports success doesn’t prove the data can actually come back.
What’s the difference between a backup and a recovery plan?
A backup is a copy of your data. A recovery plan is the documented, tested process for getting systems running again: who does what, in what order, and how long each critical system takes to restore.
How long does recovery take after an attack?
It varies enormously. Only 2 percent of businesses resolve an unplanned outage within a minute, while 10 percent lose a full workday or more. Documented recovery times for each system turn that unknown into something you can plan around.
Schedule a free security assessment with Cloud9 and we’ll tell you, honestly, whether your backups would actually hold up if you needed them tomorrow.