Every client we have onboarded had backups. Roughly half had backups that would have actually restored. The gap between those two sentences is where companies die.
The three failure modes we keep finding
silent job failure
The backup agent stopped reporting in March. Nobody noticed, because success emails were filtered into a folder nobody reads and failure looked identical to silence.
incomplete scope
The database was backed up. The config telling the application where the database lives was not. Restoring one without the other buys you nothing.
untested media
Backups written to a NAS on the same switch, in the same room, on the same UPS as production. Ransomware and floods both disagree with that plan.
What we do instead
- Restore tests on a schedule, not on a hunch — quarterly minimum, monthly for anything revenue-bearing.
- Restore to isolated infrastructure and time it end to end. If you cannot state your RTO in minutes, you do not have one.
- One copy off-network and immutable. Not off-site. Off-network.
- Alert on the absence of a success, not only on an explicit failure.
Last verified restore of a client production database — checksums matched, timed end to end, on a Tuesday when nothing was on fire.
None of this is clever. It is just the difference between a line item and an insurance policy.