Verizon's 2025 Data Breach Investigations Report makes for hard reading if you run a small or mid-market business. Ransomware now features in 88% of SMB breaches — up sharply on prior years. System-intrusion incidents are linked to ransomware 75% of the time. And the operators are getting faster: in North American mid-market environments, the report flags backup disruption as a priority action inside the first hour of intrusion.
The implication: if your backup runs to a network share that the attacker can also reach, you have one backup. If your backup runs on the same auth domain as the production environment, you have one backup. If your backup hasn't been restore-tested this quarter, you don't know whether you have a backup at all.
Immutable storage, offline credentials, monthly restore tests, and a separate identity boundary for the backup platform are no longer best-practice. They're the baseline.