Backups Don’t Matter. Restores Do.

If you’ve worked in IT long enough, you’ve heard some variation of this:

“Don’t worry. We’ve got backups.”

It’s one of those sentences that sounds reassuring right up until someone asks the follow-up question.

“Have you restored from them?”

Silence.

The uncomfortable reality is that a backup isn’t proof that your data is safe. It’s simply evidence that software believes it copied something somewhere. Whether that copy is complete, readable, and recoverable is an entirely different question.

I’ve seen backup jobs report success while silently skipping critical databases because permissions changed. I’ve seen storage arrays happily replicate corrupted data to every site in the company. I’ve even seen tape rotations carried out religiously for years without anyone ever attempting a restore.

Every one of those organizations believed they had a disaster recovery plan.

What they actually had was a backup schedule.

Those are not the same thing.

A backup is a process.

A restore is a capability.

The difference only becomes apparent when something goes wrong.

Unfortunately, that’s also the worst possible time to discover your backup software can’t read the media, the encryption password was lost five years ago, or the only person who understood the process retired.

This is why every backup strategy should include regular restore testing.

Not theoretical testing.

Actual restores.

Recover a virtual machine.

Restore a mailbox.

Bring back an individual file.

Spin up a copy of a database and verify the application can use it.

The goal isn’t simply proving the software works. It’s proving your procedures work.

Can the team find the correct backup?

Do they know which credentials are required?

How long does recovery actually take?

Are the recovery time objectives realistic?

Does anyone know what to do if the primary backup server is the thing that failed?

These questions are impossible to answer with a green checkmark in a dashboard.

There’s another misconception worth addressing.

Replication is not a backup.

Snapshots are not backups.

RAID is not a backup.

High availability is not a backup.

Every one of those technologies improves resilience, but none of them protect you from every failure.

Delete a file.

Encrypt an entire volume with ransomware.

Corrupt a database.

Watch those changes replicate beautifully to every redundant copy you own.

Computers are exceptionally good at repeating mistakes very quickly.

At the end of the day, backup software isn’t what protects your data.

Testing does.

Because nobody has ever lost sleep over a successful backup job.

They lose sleep over the first restore.