October is Cyber Security Awareness Month, which means your feeds are full of advice about stopping attacks. Firewalls, training, strong passwords, all of it right, and we have written plenty of it ourselves. But prevention is only half the story, and it is not the half that decides whether a business survives.
The deciding question is the one almost nobody asks out loud: if ransomware got through anyway, could we actually recover? Here is how to answer it honestly.
What actually happens when ransomware lands
It usually starts quietly, often with a single phishing email. Then one morning files will not open, filenames look scrambled, and there is a note demanding payment for the key. By then it has typically spread to everything the infected machine could reach: shared drives, other PCs, and, because OneDrive and SharePoint faithfully sync whatever changes, the encrypted copies overwrite the good ones in the cloud too.
From that moment the business is stopped, and every hour of downtime has a cost: wages for a team that cannot work, calls unanswered, orders not going out. Recovery speed is what separates a bad day from a threat to the business.
Why "we have backups" is often not true in practice
Almost every business we meet says they have backups. Under the surface, the same four problems come up again and again:
- The backups live on the same network. A backup drive plugged into the server, or a share the infected machine could reach, gets encrypted right alongside everything else. Ransomware gangs go looking for backups first, precisely because destroying them forces payment.
- Nobody has ever restored from them. The backup job says "success" every night, and nobody has tested whether the data actually comes back, or how long it takes. A backup nobody has restored from is a hope, not a plan.
- They cover the wrong things. The old server gets backed up faithfully while the Microsoft 365 data, where the business actually lives now, has nothing beyond the recycle bin.
- The retention is too short. Attackers often sit quietly inside a network for weeks before encrypting. If every backup you hold is newer than the break-in, you restore the infection along with the data.
Why paying is not a plan
Faced with no working backups, some businesses pay. It rarely goes the way they hope. There is no guarantee the key works or that all the data comes back, you mark yourself as a business that pays, and the money funds the next round of attacks. The National Cyber Security Centre and the Information Commissioner have both been blunt about discouraging payment. The honest version: by the time paying feels like the only option, the real failure happened months earlier, in the backup setup.
What recovery-ready actually looks like
None of this is exotic. A recovery-ready small business has four things:
- A copy the attacker cannot touch. At least one backup copy offline or immutable, meaning it cannot be altered or deleted even with stolen admin credentials. This is the single difference that defeats the "destroy the backups first" playbook.
- Cover for everything that matters. Servers and PCs, yes, and also Microsoft 365: mailboxes, SharePoint, OneDrive and Teams.
- Tested restores with a known time. Not "we think it works" but "we restored last quarter, and a full recovery takes about this long." Hours versus weeks is a design decision, and it gets made before the attack or not at all.
- A written plan for the first day. Who disconnects what, who calls whom, in what order things come back. In the moment, nobody thinks clearly without one.
Prevention still matters, obviously
None of this replaces stopping attacks in the first place. The basics in Cyber Essentials, multi-factor authentication, patching and a team that can spot a phishing email prevent the vast majority of incidents. Recovery is the layer underneath, for the day something gets through anyway. Strong businesses have both. Fragile ones have one or neither.
The one question to ask this month
If Cyber Security Awareness Month prompts a single action in your business, make it this question, put to whoever looks after your IT:
"When did we last actually restore something from backup, and how long did a full recovery take?"
A confident, specific answer means you are in good shape. A pause means you have found the gap while it is still cheap to fix.
How we help
Our backup and disaster recovery service is built around exactly this: an untouchable copy of everything that matters, Microsoft 365 included, restores that are tested rather than assumed, and a recovery plan with your name on it. It sits alongside the cyber security layer that stops most attacks ever getting that far.
If you cannot answer the restore question with confidence, we will happily test it with you and tell you honestly where you stand. Better to find out on a quiet Tuesday than the morning of the note.