74% of UK Businesses Have Cloud Backups — But Most Have Never Tested a Restore

The UK Cyber Security Breaches Survey 2025/2026, published on 30 April 2026, contains a finding that should concern any IT lead or business owner who thinks their backup situation is sorted.

Seventy-four per cent of UK businesses now have secure cloud backups in place. That is genuinely encouraging progress. But in the same survey, 75% of businesses have no formal incident response plan. Put those two numbers together and you get an uncomfortable picture: most organisations have backups they have never actually tested in a realistic recovery scenario.

Having a backup is not the same as being able to recover. And right now, that distinction matters more than it ever has.

What "Tested" Actually Means

A backup job completing successfully overnight tells you one thing: that data was copied somewhere. It does not tell you that the data is intact, that it can be restored within an acceptable timeframe, or that the restored systems will actually work.

A restore test means pulling data back from your backup, onto a system, and confirming that it functions as expected. It sounds obvious. Most businesses do not do it.

The reasons are understandable. Testing takes time and resources. It can feel unnecessary when nothing has gone wrong. And if backups are managed by a third party, there is often an assumption that someone else is keeping an eye on it.

But assumptions about recoverability are not the same as evidence of it. And increasingly, that evidence is what people are asking for.

Insurers Are Asking Questions You May Not Be Able to Answer

This is where the backup testing gap starts to have direct financial consequences.

Cyber insurers are now routinely asking for documented restore test evidence — with dates — as part of claim validation. Backup logs that show a job completed are no longer sufficient. Insurers want to see proof that you can actually recover, not just that data was written to a backup location.

If you have never run a restore test, you will not have that evidence. And if you cannot provide it when a claim is under review, you may find your insurer has grounds to dispute or reduce a payout at exactly the moment you need it most.

This is not a theoretical concern. It is a pattern that is already emerging across the industry as ransomware claims increase and insurers scrutinise policies more carefully.

Ransomware Has Changed What "Backup" Needs to Mean

There is another complication worth being direct about. Ransomware attacks increasingly target backup infrastructure alongside production systems. Attackers know that a working backup is the primary recovery route, so they go after it first.

This means that a backup sitting on the same network, or accessible through the same credentials as your live systems, may be compromised before you even know an attack is happening. Air-gapped or immutable backups — where data cannot be modified or deleted by an attacker who has gained access to your environment — are the response to this. But they need separate verification. You cannot assume they are working just because your standard backup job is running.

Testing a restore from an immutable or air-gapped copy is a different exercise from testing a standard backup, and it needs to be treated as such.

How Often Should You Actually Be Testing?

Industry guidance has shifted on this. The current expectation, reflected in frameworks and increasingly in insurance requirements, is:

• Monthly validation for mission-critical workloads
• Quarterly restore tests for core business systems
• Annual full disaster recovery tests at minimum, simulating a realistic failure scenario

For most SMBs, getting to quarterly restore tests for core systems would represent a significant improvement on where they are today. That is a realistic and worthwhile starting point.

The key discipline is documentation. A restore test that is not recorded — with a date, the systems covered, the outcome, and who signed it off — is worth considerably less than one that is. Insurers, supply chain partners, and procurement teams evaluating your cyber maturity are increasingly asking to see this kind of evidence. Verbal assurances will not cut it.

What This Means in Practice

The 2026 Breaches Survey confirms what many IT professionals already suspect: backup adoption has improved, but backup confidence is not the same as backup capability. The organisations that will fare best after an incident are the ones that can demonstrate — with dated evidence — that they have tested recovery and know it works.

That requires a process, not just a tool. It requires someone to own it, schedule it, and document it. And it requires a backup approach that accounts for hostile scenarios, not just accidental data loss.

If you are not sure when your backups were last tested, or whether you could provide restore evidence to an insurer today, that is worth addressing before you need to find out the hard way.

---

IronFell manages backup and restore testing as part of a single service — so you always have current evidence of recoverability, not just logs showing a job ran. Get in touch to find out how it works for businesses like yours.