75% of small businesses hit with ransomware can't continue operating. Not "experience a slowdown." Can't operate. The Datto Global State of the Channel Ransomware Report found that downtime costs for SMBs after an attack average $274,200 — and that's before you factor in reputation damage, lost contracts, and the regulatory fallout if customer data was involved. The median ransom demand in 2025 is over $200,000, according to Sophos' annual ransomware report.

But here's the part that doesn't get enough attention: businesses with proper backups almost never pay the ransom. They restore from a clean copy and move on. The entire ransomware model collapses when your data exists somewhere the attacker can't reach.

This isn't a complicated problem. It's an under-practiced one.

The 3-2-1 backup rule (and why it still holds up)

The 3-2-1 rule has been the standard since before ransomware was a household word, and it still works because the logic is sound:

3 copies of your data (the original plus two backups)
2 different media types (local drive plus cloud, or NAS plus external drive — not two copies on the same device)
1 copy offsite (physically or logically separated from your primary network)

The reasoning behind each number is about eliminating single points of failure. One backup can fail. Two backups on the same drive die together. A backup sitting on the same network as your production systems can be encrypted by the same ransomware that hit everything else — CISA's ransomware guide specifically warns about this.

The offsite copy is your insurance policy. It's the one that survives when everything on your network is compromised. If you take nothing else from this article, take this: at least one backup must live somewhere your primary network cannot reach.

Three external hard drives arranged on a desk next to a locked safe, representing the 3-2-1 backup rule with multiple copies across separate media — The 3-2-1 rule survives because the math is simple: eliminate every single point of failure between you and your data.

What to back up (it's more than files)

Most people think of backups as "my documents and photos." That's the floor, not the ceiling. A business backup that lets you actually recover needs to include:

Files and documents — the obvious layer. Client deliverables, contracts, internal documents, media assets.
Databases — if you run any application with a database behind it (CRM, project management, accounting software, a website), the database needs its own backup process. File-level copies of a running database can produce corrupted backups. Use the application's built-in export or a proper database dump tool.
Configurations — server configs, application settings, DNS records, firewall rules. Rebuilding a server from scratch without these means days of detective work figuring out how things were set up. Document them and back up the documentation.
Credentials vault — your password manager's encrypted export, API keys, license keys, certificates. If your team uses a password manager (and they should — see five cybersecurity things every business should do first), schedule regular encrypted exports to your backup.
Email — if you're on a hosted provider like Google Workspace or Microsoft 365, your email is in the cloud, but that doesn't mean it's backed up. Google's shared responsibility model makes it clear that data protection is your responsibility. Third-party email backup tools exist for exactly this reason.

A useful test: if your office burned down tomorrow and you had to set up on new hardware, could you get back to operational from your backups alone? If the answer involves "well, I'd need to call someone to get..." then that thing needs to be in the backup.

How often to back up

The right backup frequency depends on how much work you can afford to lose. This is called your Recovery Point Objective (RPO), and the calculation is straightforward: if you back up nightly and get hit at 4 PM, you lose a full day's work. If that's acceptable, nightly is fine. If losing a day's work means re-entering 200 client records, you need more frequent snapshots.

Practical guidance for most small businesses:

Critical databases — every 1-4 hours, automated
Active project files — daily, automated
Configuration and credentials — weekly, plus after any significant change
Full system images — weekly or monthly

Automated is the operative word. Manual backup processes are backup processes that stop happening the first week someone gets busy. Every modern backup tool supports scheduling. Use it.

A calendar with automated backup schedule markings and a clock showing recurring intervals, illustrating consistent backup timing for business continuity — Backup frequency should be based on how much work you can afford to lose, not how often you remember to run the process.

Cloud vs. local vs. both

This isn't an either/or decision. Cloud and local backups solve different problems:

Local backups (external drives, NAS devices) give you fast restore times. If you need to recover a 50 GB database, pulling it from a drive on your desk takes minutes. Pulling it from the cloud takes hours. Local backups also don't depend on internet connectivity.

Cloud backups give you geographic separation. A fire, flood, or theft that destroys your office won't touch your cloud backup. Cloud storage is also harder for ransomware to reach — particularly if it uses immutable storage, which prevents existing files from being modified or deleted for a set retention period.

The 3-2-1 rule accommodates both. Local drive for speed, cloud for disaster resilience. If you only pick one, pick cloud — the offsite copy is the one that saves you from ransomware scenarios where the attacker has been on your network for weeks before triggering the encryption.

How to test restores (the step almost everyone skips)

A backup you've never tested is a backup you're hoping works. Hope is not a recovery strategy.

The Veeam Data Protection Trends Report found that 58% of backup restores fail. More than half. The backup ran every night, the logs looked clean, and when it was actually needed, the data was incomplete, corrupted, or in a format nobody could use.

Testing means actually performing a restore — not just checking that the backup job completed. At minimum, quarterly:

Pick a random backup set — not the most recent one, which is most likely to work. Pick one from three weeks ago.
Restore it to a separate location — not over your production data. A test machine, a different folder, a sandbox environment.
Verify the data — can you open the files? Does the database start? Are the records current as of that backup date? Can the application actually run on the restored configuration?
Time the process — how long did full restoration take? That's your Recovery Time Objective (RTO) in practice, not in theory.

Document the results. If the restore took six hours and your business can't survive six hours of downtime, you need a faster restore path — a local backup, a hot standby, or a simpler system architecture. This is exactly the kind of information you want before an incident, not during one. Knowing what the first 48 hours of a breach look like makes it clear why "figure it out during the crisis" isn't a plan.

Before AI / Now with AI

Before AI

Ransomware was a blunt instrument. Attackers would encrypt everything they could reach, as fast as possible, and hope the damage was extensive enough to force payment. Backup strategies designed around this — offsite copies, network segmentation, regular rotation — were effective because the attack was indiscriminate. If your backup was separate from your network, it survived.

Now with AI

AI-augmented ransomware changes the calculus. Modern variants can identify your most valuable files before encrypting — prioritizing databases, financial records, and client data over stock photos and old meeting notes. More critically, AI-driven attacks can detect and target backup connections themselves, identifying mounted backup drives, cloud sync agents, and shadow copies, then deleting or encrypting them before the primary attack begins.

The Darktrace threat research has documented ransomware strains that specifically scan for backup infrastructure as a first step. The encryption of production data is the second step — once the safety net is gone.

The defense hasn't changed in principle, but it's gotten more specific: air-gapped backups. An air-gapped backup is one that is physically or logically disconnected from your network except during the backup window. A USB drive that you plug in for the backup and unplug when it's done. A cloud backup that uses write-only credentials (the backup agent can upload but can't delete or modify existing backups). Immutable storage that rejects deletion requests for a set retention period, regardless of who — or what — makes the request.

AI also works on the defensive side. Backup monitoring tools now use anomaly detection to flag unusual patterns — a sudden spike in file modifications (which often precedes encryption), backup sizes that shrink unexpectedly (suggesting files were deleted before the backup ran), or backup jobs that start failing after months of clean runs. These early warnings can be the difference between catching ransomware in its staging phase and discovering it after everything is encrypted.

The principle is the same as it was before AI entered the picture: your last line of defense must exist somewhere the attacker cannot reach. AI just made "cannot reach" a higher bar to clear.

A disconnected external drive sitting inside a fireproof safe with the door open, symbolizing air-gapped backup storage that ransomware cannot access remotely — Air-gapped backups remain the strongest defense against AI-targeted ransomware because they exist outside the attacker's reach.

Where to start today

If you have no backup system in place, start here:

Inventory what matters — files, databases, configs, credentials, email. If you can't rebuild from it, it needs to be backed up.
Set up automated daily backups to a local device and a cloud service. Use the 3-2-1 rule as your framework.
Make at least one copy air-gapped — a rotated USB drive in a safe, or immutable cloud storage. This is non-negotiable for ransomware resilience.
Test a restore this month — not next quarter, this month. Pick a random backup, restore it, and verify the data is usable.
Put it on the calendar — quarterly restore tests, documented. Treat it like a fire drill, because that's what it is.

The businesses that survive ransomware aren't the ones that paid the ransom. They're the ones that didn't need to. The difference is a backup strategy that was set up correctly and tested regularly — nothing more exotic than that.

External hard drive connected to laptop with hot pink LED — backup strategy by Amelia S. Gagne — The 3-2-1 backup rule: three copies, two different media types, one offsite. It's been the standard since before ransomware existed, and it still holds because the principle — redundancy against single points of failure — is timeless.

Frequently Asked Questions

How much does a proper backup system cost for a small business?

A basic 3-2-1 backup setup can cost under $200/year. A quality external drive runs $50-100, and cloud backup services like Backblaze or Wasabi start at $5-7/month per terabyte. Enterprise-grade immutable storage adds cost but is increasingly available at SMB price points. The math is simple: compare $200/year to $274,200 in average ransomware downtime costs. The backup pays for itself if it prevents even a few hours of downtime over its lifetime.

If I use cloud services like Google Workspace or Microsoft 365, aren't my files already backed up?

No. Cloud platforms protect against their own infrastructure failures — hardware faults, data center outages. They do not protect against ransomware encrypting files via your synced account, accidental deletion, or a compromised admin account wiping data. Both Google and Microsoft operate on a "shared responsibility model" where data protection is explicitly your responsibility. You need a third-party backup that copies your cloud data to a separate, protected location.

What's the difference between an air-gapped backup and a regular offsite backup?

An offsite backup is stored in a different physical location — a cloud server, a drive at a second office. An air-gapped backup goes further: it's disconnected from your network entirely except during active backup windows. A regular cloud backup syncing continuously can still be reached by ransomware through your sync agent's credentials. An air-gapped backup — whether a USB drive that's physically unplugged or cloud storage using write-only, time-locked immutable policies — can't be touched because there's no live connection to exploit.

How long does a full business restore actually take?

It depends on data volume and your restore method. A local backup of a small business (under 500 GB) can restore in 1-4 hours. A cloud restore of the same data over a standard business internet connection might take 12-24 hours. Full system rebuilds — where you're reconfiguring servers and applications from scratch, not just restoring files — can take 2-5 business days even with good backups. This is exactly why testing restore times matters: you need to know whether your recovery timeline matches what your business can survive.

Can ransomware encrypt cloud backups?

Yes, if the backup maintains a live connection to your network. Ransomware that compromises an account with access to cloud storage — through synced folders, API keys, or saved credentials — can encrypt or delete cloud backups just as easily as local files. This is why immutable storage and write-only backup credentials matter. With immutable storage, even a fully compromised account can't modify or delete existing backups during the retention window. It's the closest thing to a guarantee in backup security.

Backups

How to Back Up Your Business So Ransomware Can't Hold You Hostage