Confidence is not evidence - why backup strategy needs a reality check

Nicolas Blank of NBConsult, a division of Cyberlogic, argues that a backup only counts once it has been proven to restore under pressure.

Cape Town, South Africa - 24 July 2026 - Backup, disaster recovery and operational resilience are often used interchangeably in boardroom conversations, but they are three distinct disciplines that each carry their own risk if left unaddressed. This is according to Nicolas Blank, CTO at NBConsult, a division of Cyberlogic, part of the Hyperclear Tech group, who says organisations that conflate the three are frequently the ones caught out when ransomware strikes.

“Backup protects recoverable copies of information. Recovery defines how applications, identities, configurations and dependencies are rebuilt. Resilience determines whether the business can keep operating while all of that happens,” says Blank. “Every critical service needs an agreed recovery point objective, recovery time objective, restoration sequence and accountable owner, without that, a recovery plan is just a hope.”

Beyond 3-2-1: building for ransomware resilience

Blank says best practice has traditionally started with the 3-2-1 rule: three copies of data, on two different media, with one copy held off-site. In today’s threat environment, he argues, that rule needs to be extended.

“For modern ransomware resilience, I recommend extending this to 3-2-1-1-0: one copy must be offline or immutable, with zero unverified backup errors,” he explains. “Most importantly, a backup is only a backup when you have successfully restored it. Recovery tests must prove that the data is intact, the required recovery time objective can be achieved, and the organisation knows how to perform the restore under pressure.”

Blank points to research from Veeam’s 2026 Data Trust and Resilience study, which found that nearly 90% of security leaders believed they could recover quickly following an attack, while only 28% actually achieved a full data recovery after a ransomware incident.

“Confidence is not evidence,” says Blank. “A tested restore is.”

Designing backups to survive the attacker, not just the outage

Microsoft’s own ransomware guidance asks a pointed question of every organisation: are backups of the application, configuration and data available, and are they regularly verified through restore exercises? Blank says this framing matters because a recovery plan that restores files but cannot restore identity, application configuration or business operations remains incomplete.

“Backups have to be designed on the assumption that an attacker will actively try to find, encrypt or delete them,” he says. Organisations should use immutable or offline copies, separate backup administration from production administration, protect backup accounts with phishing-resistant multi-factor authentication and privileged access controls, and ensure that compromised production credentials cannot modify retention policies or delete recovery points. Backup deletion and unusual administrative activity should themselves be treated and monitored as security events.

This discipline, Blank stresses, needs to extend to Microsoft 365 and other SaaS platforms with the same rigour applied to on-premises infrastructure. “Microsoft’s shared-responsibility model is clear that customers retain responsibility for their data, identities, configurations and data protection decisions, including when using SaaS services such as Microsoft 365,” he says. Microsoft 365 Backup, or an appropriate third-party service, can protect Exchange Online, SharePoint and OneDrive data, with Microsoft’s own platform using append-only storage and immutable recovery points designed to resist malicious overwrite.

Where AI helps and where it can’t

Artificial intelligence is increasingly being layered into backup and recovery operations, but Blank is careful to frame its role. “AI can improve a backup policy, but it cannot rescue a fundamentally weak one,” he says.

Its most useful applications, according to Blank, are detecting abnormal deletion or encryption patterns, identifying unexpected changes in backup size or duration, predicting failed jobs, prioritising systems according to business impact, and automating evidence collection from restore tests. AI can also help model recovery scenarios and identify dependencies that traditional asset inventories have missed.

“However, AI recommendations must remain governed by documented retention requirements, recovery objectives and human approval,” he cautions. “The danger is allowing automation to create a false sense of assurance. An AI dashboard reporting healthy backups is still not proof that the organisation can recover.”

Blank’s conclusion is unambiguous: the final measure of readiness must remain a clean, timed and independently verified restoration of the business service, not merely the successful completion of a backup job. Ends

About NBConsult

NBConsult is a specialist cybersecurity and governance consultancy and a division of Cyberlogic, part of the Hyperclear Tech group. NBConsult works with organisations to strengthen their security posture, governance frameworks, and operational resilience against evolving cyber threats.

For more information

Samantha Hogg-Brandjes | GinjaNinja | This email address is being protected from spambots. You need JavaScript enabled to view it. | +27-84-458-4857