Having a backup strategy in place can create a strong sense of security. Backup jobs are running, policies are documented, copies are stored in different locations, and teams know what they are expected to do during an incident. But confidence in those controls does not necessarily mean an organization can recover when a serious disruption occurs.
That distinction is becoming harder to ignore. Veeam’s 2026 Data Trust and Resilience Report found that 90% of organizations are very or extremely confident they can recover within their defined recovery time objectives (RTOs). yet only 69% say those RTOs fully align with business continuity requirements. The gap is not necessarily a lack of technology. It is the difference between having recovery mechanisms and being able to prove they will work when the business needs them most.
Backup Is Not the Same as Recovery
A successful backup only confirms that data was copied. It does not confirm that the data is recoverable, that applications can be restored in the right order, or that the business can return to normal within its required timeframe.
Modern environments make this increasingly complex. Applications depend on databases, identity services, infrastructure platforms, APIs, and other workloads. Recovering one system may therefore depend on recovering several others first. A backup strategy that looks strong when viewed workload by workload can become far less effective when the entire environment has to be brought back online.
This is why recovery needs to be considered as an operational capability rather than simply a storage function. The real question is not whether backups exist, but whether the organization can restore the right data, systems and services in the right sequence and within an acceptable timeframe.
Ransomware Changes the Recovery Equation
Ransomware makes this distinction even more important. An organization may have multiple recovery points and still discover during an attack that some are compromised, incomplete or unsuitable for restoration.
Veeam’s latest research shows that nearly three in ten organizations experienced a cyber incident that resulted in data loss, downtime, or operational disruption. Among organizations affected by ransomware, only 28% reported fully recovering all affected data, while 44% recovered less than 75%.
That changes the role of backup. Recovery points need to be protected from compromise, their integrity needs to be understood, and recovery processes need to account for the broader environment rather than focusing only on individual files or systems.
Immutable backups can play an important role here, but immutability alone does not create resilience. An organization also needs confidence that the protected data is usable, that dependencies are understood, and that recovery procedures have been validated.
Recovery Has to Be Tested, Not Assumed
One of the biggest weaknesses in many disaster recovery strategies is the assumption that a documented process is a proven process.
Recovery testing provides the evidence that documentation cannot. It can reveal missing dependencies, outdated credentials, incompatible configurations, unrealistic RTOs and recovery sequences that look logical on paper but fail under real conditions. Testing also needs to go beyond checking whether a backup can be restored. The more useful question is whether critical business services can actually be brought back online and operate as expected.
Regular testing therefore turns recovery from an assumption into a measurable capability. It also gives technology and security teams the opportunity to identify weaknesses before a ransomware attack, outage or other major disruption exposes them.
What Should Be Measured?
A stronger recovery strategy needs measurable outcomes. RTO and recovery point objectives (RPO) remain important, but they should be supported by evidence from actual recovery exercises.
That means looking at how consistently recovery targets are achieved, how often recovery procedures are tested, whether clean recovery points can be identified, how quickly critical applications can be restored and whether dependencies across the environment are properly understood. There is also an organizational dimension. Recovery cannot sit entirely with the backup team. Business owners, infrastructure teams, security teams and leadership all need clarity around what must be recovered first, how recovery decisions are made and what level of disruption the business can realistically tolerate.
The objective is not to create more metrics for the sake of reporting. It is to build a clear picture of whether the organization can recover when the pressure is real.
From Backup Strategy to Recovery Confidence
The shift from backup to recovery confidence represents a broader change in how resilience should be approached.
Instead of asking, “Do we have backups?” The more important questions are: Can we recover from them? Can we recover cleanly? Can we recover within the required timeframe? And have we demonstrated that capability recently?
Those questions connect backup strategies with disaster recovery, business continuity and cyber resilience. They also help organizations move away from measuring resilience by the amount of data protected and toward measuring the outcomes that protection is supposed to deliver.
As environments become more distributed and threats become more sophisticated, that distinction will only become more important. Recovery needs to be engineered, tested and continuously improved rather than treated as something that will simply work when required.
Building Measurable Resilience with Tsunati + Veeam
At Veeam University powered by Tsunati, we help IT professionals develop practical, measurable capabilities through courses focused on data protection and cyber resilience. Our training helps learners understand how to design, manage and optimize Veeam environments for effective recovery.
The goal is not simply to keep backups running successfully. It is to ensure recovery can be tested, measured, and demonstrated because when ransomware or a major disruption occurs, confidence alone will not restore the business.
Add your first comment to this post