Backups you haven't tested aren't backups. They're hope.

Every business we take on has backups. That's the good news.

Most of them haven't been test-restored in the last 12 months. That's the less-good news.

A backup you haven't restored isn't a backup. It's hope

We've walked into environments where the backup job had been running green for 18 months. Green ticks. Success emails. Everyone happy. When we ran a real restore, it didn't. The job had been running against an old drive that had been quietly disconnected. The successful "runs" were successful runs of a job that was backing up nothing.

That's not a horror story. That's Tuesday.

What we do about it, as baseline

Backup verification — regularly confirming that your backups actually restore, not just that the job ran — is part of the Support & Maintenance baseline included with every managed engagement.

What backup verification actually involves

• Sample restores on a schedule. Not just the metadata check. Actual data pulled back to a real location.
• Rotating scope. File shares one month. Email another. Whole-machine restores on the schedule that makes sense for the environment.
• Timed restore drills. So we know how long a real recovery would actually take, not how long we hope it would.
• Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) written down — and honest about whether the current backup regime meets them.
• Immutability check. So the backups can't be encrypted by the same ransomware that hit the production data.
• Documentation of the actual process. Because knowing "there's a backup somewhere" is not the same as being able to point to the runbook at 2am.

Where most SMB backups genuinely fail

• Microsoft 365. Because "the cloud" is not a backup. See the next article.
• Old on-prem tools. Where the software's still running but the vendor stopped supporting it three versions ago.
• NAS backups on the same physical site. A fire or a flood takes both.
• Backups without immutability. Which means ransomware can encrypt the backup while it's encrypting production.

The plain-English test

Ask your current provider: "What was the last successful test-restore, and what did you restore?" If they can't answer with a date and a scope, you don't have a backup. You have a hope.