Backups Don't REALLY Protect You From RANSOMWARE! What To Do Next

Summary of the Video’s Main Points (Backups and Ransomware)

• Backups alone don’t protect you from ransomware—recovery and continuity matter. The discussion emphasizes a “gap” between having backups and being able to actually restore systems quickly enough to keep the business operating (business continuity).

• Many organizations are overconfident and rely on “blind trust.” Presenters note that leaders often assume backups work because they exist, but they typically don’t test restores or validate that recovery will meet real business needs. When restoration fails, it becomes chaotic and costly.

• Key business metrics: RPO and RTO.

  • RPO (Recovery Point Objective): how much data loss is acceptable (time since last successful backup).
  • RTO (Recovery Time Objective): how long the business can be down before operations are seriously harmed. Testing is presented as the only way to know whether stated RPO/RTO targets are realistic.

• Ransomware is “organized crime,” and attackers aim at backups first. The video argues that ransomware operations aren’t lone hackers—they use teams, shift structure, and “toolkits as a subscription.” A major tactic is to find, copy, and steal backups, and sometimes delete or corrupt them, preventing straightforward recovery.

• A key real-world contrast: paying ransom vs. being able to recover quickly.

  • A city in Alabama (Florence) reportedly faced ransomware after ignoring warnings, became unusable for about 30 days, and ultimately paid $330,000.
  • A packaging company in the same region reportedly faced the same criminals/attack vector but paid nothing, because it had a working response approach via its MSP and was restored quickly (described as “in 20 minutes”).

• Disaster recovery planning is distinct from backups. Presenters stress that disaster recovery is the broader plan for continuity (people, process, priorities, restoration order, tested runbooks)—not just storage of backup data.

• Immutable backups help prevent backup tampering/deletion.

  • “Immutability” is described in non-technical terms as backups being air-gapped/hardened so attackers can’t alter or delete them after compromise.
  • The video links this to ransomware reality: if “restoration” ends up as corrupted data or ransom notes—or if backups are deleted—immutable protection keeps the “gun in your hand,” not removed by the attacker.

• Cloud recovery can reduce downtime when systems are temporarily spun up. Instead of replacing hardware for days, cloud DR can bring systems back in hours. A story is shared about a business that rebuilt operations in the cloud after a catastrophic event and then transitioned back later, without losing customer records.

• Downtime costs are broader than “lost files.” The video highlights:

  • halted operations and lost revenue,
  • idle labor costs,
  • an extended recovery “long tail,”
  • intangible losses like reputation damage, customer/partner trust, and potential litigation exposure.

• Practical 90-day action plan for business owners:

  • First 30 days: assess current backup/recovery capabilities.
  • Next 30 days: define/validate recovery strategy, set realistic RPO/RTO, and prioritize what must come back first.
  • Final 30 days: test the recovery process repeatedly and document runbooks so the organization can execute under pressure.

• Involving the right partners (CFO + IT provider/MSP/reseller) is essential. The presenters argue recovery readiness must be owned at the leadership level (including finance), and that external experts should be part of the business continuity strategy—not treated as “just IT.”

• Traditional phishing training is becoming less effective due to AI. Because AI improves the realism of phishing/spearfishing, the advice shifts to verifying the human (e.g., call the known contact, confirm by a trusted channel) rather than relying on old “spot-the-red-flags” training.

---

Presenters / Contributors

• David Dean Morrow (Vice President of Strategic Growth, Net Gain Technologies) — moderator
• Tyler Bowman (Senior Lead Engineer, Net Gain Technologies)
• Matt Scully (Subject Matter Expert, CASSA Data)