Here is an uncomfortable truth. Roughly one in three UK businesses that get hit with ransomware discover their backups are broken, incomplete, or unusable in the exact moment they need them. Not months later. Not during a scheduled test. During the actual disaster.
That green tick in your backup dashboard is not proof of anything. It just means the software finished its run without an obvious error. Whether the data inside those backups can actually be restored to a working system is a completely separate question. And it is the only question that matters.
If you have not tested a full recovery in the last 90 days, this post is for you.
Backup software is designed to keep going. When something goes wrong, most tools will log a warning, skip the file, and move on to the next one. Your dashboard still shows a job completion. Nobody notices until the day you need to restore.
Here are the failures we see most often at Magnetar when we take over IT for a new client and audit their backups:
Every one of these looks fine in a dashboard. Every one of these turns a recoverable incident into a business-ending one.
Most IT people know the classic 3-2-1 backup rule. Three copies of your data, on two different types of media, with one copy offsite. That guidance is over 20 years old and no longer good enough.
The modern rule, used by every serious backup vendor in 2026, is 3-2-1-1-0:
That last one, the zero, is the whole point of this post. Verification is not a nice-to-have. It is the difference between having backups and having recoverable backups.
There is no single correct answer, but here is a cadence that works for the 20 to 100 staff businesses we support:
Backup software runs an automated integrity check on the latest backup files. Most modern tools including Veeam, Datto, and Acronis do this natively. Turn it on if you have not already.
Pick one server or one Microsoft 365 mailbox. Restore a folder, a file, or a mailbox to an alternate location. Verify the data opens correctly. Document what you did and how long it took. This takes about 30 minutes.
Spin up a full server from backup into an isolated environment. Log in. Open the databases. Run a report. Prove it works end to end. If your MSP cannot do this without breaking production, that is a red flag.
The full test. Assume production is gone. Restore everything, in the correct order, to hit your recovery time objective. Time it. Involve the team who would actually be doing it at 2am on a Sunday. Then update your runbook based on what broke.
If someone asks about your backups, do not tell them how many jobs ran last night. Tell them your RPO and RTO.
RPO, Recovery Point Objective, is how much data you can afford to lose. If you back up nightly at midnight and something breaks at 4pm, you have lost 16 hours of work. Is that acceptable? For most professional services firms the answer is no, and you need continuous or hourly backups for critical systems.
RTO, Recovery Time Objective, is how long you can afford to be down. Restoring a 500GB server from a cloud backup over your broadband can take 12 to 24 hours. If your business cannot survive being offline that long, cloud-only backup is not enough. You need local, fast-restore copies alongside your offsite ones.
Both numbers should be written down. Both should be agreed with the leadership team, not just the IT function. And both should be tested.
This one is worth its own section because we still meet businesses who believe Microsoft backs up their 365 data. Microsoft does not.
Microsofts own service agreement makes it clear that they run redundant infrastructure to keep the service available. They do not take point-in-time backups of your data to protect you from deletion, ransomware, malicious insiders, or an admin fat-fingering a mailbox rule. That is your responsibility.
If a member of staff leaves and their OneDrive gets automatically purged 30 days later, that data is gone. If ransomware encrypts SharePoint through a compromised account, versioning will help you for a limited window and then the versions themselves get overwritten. You need a proper third-party backup for Microsoft 365 covering:
Retention should be 12 months minimum, with the option to recover to a granular level (an individual email or a single Teams message).
Modern ransomware groups know that backups are the escape hatch. They now spend an average of 8 to 14 days inside a network before deploying encryption, and a large portion of that time is spent finding and destroying backups first.
That means any backup accessible from a compromised admin account is at risk. If your backup server sits on the domain, uses the same credentials as production, or exposes an admin web interface without MFA, it is vulnerable.
The fix is immutability. Backup storage that cannot be modified or deleted for a defined period, even by an administrator, even by the backup software itself. Every serious backup platform in 2026 supports this. Datto has immutable cloud, Veeam has hardened repositories, most cloud object storage supports object lock. Turn it on. It costs almost nothing and it is the single most effective defence against ransomware that exists today.
If you take nothing else from this post, run through this checklist with your IT team or MSP in the next seven days:
Backups are not an IT problem. They are a business continuity problem that IT owns. The businesses that survive a ransomware attack, a fire, a rogue admin, or a genuine hardware failure all have one thing in common. They tested their recovery before they needed it.
At Magnetar we spend a lot of time inside other peoples backup platforms. We know what fails, we know what quietly works, and we know how to build recovery processes that hold up when it counts. Our team resolves 89% of issues within an hour and holds a 98% client satisfaction rating, in large part because we do the boring, unglamorous work of testing recovery before disaster strikes.
Magnetar offers a free backup and recovery review for UK businesses with 20 to 100 staff. We will look at what you have, what is missing, and what would happen in a real recovery scenario. No sales pressure, just a straight answer.
Get in touch at Magnetar IT to book a review.
Date: September 8, 2026
Author: Rafael Macedo