Is Your Business Backup Ransomware-Proof? 4 Tests to Run Today

Your backup is ransomware-proof only if it passes four specific tests: a verified test restore, isolated backup storage, full data coverage (files, databases, and email), and a retention policy longer than 90 days. Most hosting backups fail at least two of these. Here is how to check yours right now, and what to do if it comes up short.

Test 1: Have You Ever Completed a Full Test Restore?

The short answer: If you have never restored your backup to a separate environment and confirmed the result works, your backup is an untested theory.

A backup job that reports "success" is not the same as a backup that can bring your business back online. The only way to know is to restore it. A test restore reveals whether all critical components are captured, whether the process is manageable under pressure, and whether the restored data actually functions.

A common failure point: a business backs up its website files but never verifies that the database is included and correctly configured. When they restore after an attack, they get an empty site shell. Acronis Cyber Protect includes a "Test Recovery" feature that spins up a recovered environment in isolation so you can verify the result without touching your live systems. Run this at least once a quarter.

What to do today: Schedule a test restore. If your current backup tool has no way to do this, that alone is a disqualifying limitation.

See how Acronis handles full system recovery →

Test 2: Is Your Backup Destination Isolated from Your Live Systems?

The short answer: If ransomware can reach your backup files from the same machine or network share it just encrypted, those backups are gone too.

Ransomware does not stop at your live data. It actively scans for accessible backup locations and encrypts those as well. An external drive plugged into your server, a network share on the same domain, or a cloud folder mapped as a drive letter — all of these are reachable.

True isolation means your backup storage is either:

• Not directly accessible from your primary network (separate credentials, separate account), or
• Immutable — meaning the storage platform itself blocks modification or deletion for a set period, regardless of who requests it.

Acronis Cloud Storage offers immutable storage as a configurable option. Once a backup is written, it cannot be altered or deleted for the retention period you define, even if an attacker gains access to your Acronis account. For a 20-workstation manufacturing business with a central file server, this distinction is the difference between a recoverable incident and a total loss.

What to do today: Check where your backups land. If they are on the same server or a mapped network drive, they are not isolated.

Test 3: Does Your Backup Cover Files, Databases, and Email?

The short answer: Website files are not your whole business. If your database and email are not explicitly covered, large portions of your operations are unprotected.

Hosting backups typically capture the website file system. They rarely capture:

• Databases — the data powering your website, CRM, accounting software, or custom applications (MySQL, PostgreSQL, SQL Server)
• Email — if you run Google Workspace or Microsoft 365, your hosting provider does not back those up
• Workstation files — documents, spreadsheets, and local project files on employee machines

A ransomware attack encrypts everything it can reach across your network. Restoring only your website files while losing your customer database or two years of client email is not a recovery — it is a partial rebuild with significant gaps.

Acronis Cyber Protect covers physical servers, Windows and macOS workstations, Linux servers, SQL databases, Microsoft Exchange, Microsoft 365, and Google Workspace from a single management console. For a 10-person real estate agency, that means client records, contracts in email, and the CRM database are all in scope — not just the public-facing website.

What to do today: List every system your business depends on. Check whether each one is explicitly included in your current backup scope.

Check current Acronis Cyber Protect pricing →

Test 4: Does Your Retention Policy Go Back Further Than 90 Days?

The short answer: Ransomware regularly sits dormant for 30 to 90 days before triggering. A 14-day or 30-day retention policy means your oldest available backup may already be infected.

This is the test most businesses fail without realizing it. The math is straightforward: if ransomware enters your system on day 1, lies dormant for 45 days, and triggers on day 46, a 30-day retention policy means your oldest available restore point is from day 16 — which was already compromised. You would be restoring the infection.

A 90-day minimum gives you a reasonable window to identify the compromise date and find a clean restore point before it. For businesses with higher risk tolerance or compliance requirements, 180 days is more appropriate for certain data sets.

Calculated storage cost context: Keeping 90 days of incremental backups for a 500GB dataset at typical cloud storage rates runs roughly $15–$25/month depending on the provider. That cost is minor relative to the average SMB ransomware recovery bill, which IBM's 2023 Cost of a Data Breach report places at over $165,000 for businesses under 500 employees when recovery extends beyond 24 hours.

Acronis supports configurable retention across multiple recovery point tiers — daily, weekly, and monthly — so you are not storing full snapshots for every single day.

What to do today: Open your backup settings and find the retention policy. If it is under 90 days, change it.

Acronis Cyber Protect: What It Gets Right and Where It Has Friction

Acronis addresses all four tests above in a single platform. Before recommending it outright, here is an honest assessment.

What works well

• Active ransomware detection. Acronis monitors process behavior in real time. When it detects file encryption patterns, it can block the process and restore affected files from a local cache before the attack completes. This is a meaningful layer of protection beyond pure backup.
• Immutable cloud storage. Backups stored in Acronis Cloud cannot be modified or deleted for the retention period you set — even by someone with account access.
• Full coverage. One console handles workstations, servers, databases, Microsoft 365, and Google Workspace. You are not stitching together three separate tools.
• Flexible retention. You set the policy. 90 days, 180 days, longer — storage cost scales, but the capability is there.

Real friction points

• Higher cost than hosting backups. Hosting backup features are often included in your plan at no extra charge. Acronis is a separate line item with a real monthly cost. That trade-off is worth it for businesses that depend on their data daily, but it is a cost decision, not a free upgrade.
• Initial configuration requires attention. Setting up backup plans to cover all data sources, configuring retention correctly, and running a first test restore takes a few hours. It is not complex, but it does require someone to work through it deliberately.
• First backup is bandwidth-heavy. The initial full sync to the cloud can run for hours or days depending on your data volume and internet connection speed. Plan it for off-hours.

Real-World Scenario: A 60-Day Dormant Attack

An architecture firm with 12 employees ran a file server for CAD project files and handled all client communications through Microsoft 365. Their backup: an external drive attached to the server, with 14-day retention.

Ransomware entered via a phishing email on day 1. It sat dormant for 60 days, mapping the network and identifying both the file server and the attached backup drive. On day 61, it triggered — encrypting the live CAD files, the backup drive, and any locally cached files.

Their 14-day retention meant every available restore point was from after the infection. The backup drive was physically attached and encrypted along with everything else. Recovery required rebuilding from scratch.

After switching to Acronis with 120-day retention and immutable cloud storage:

• Active protection detected anomalous encryption behavior on the first infected workstation and blocked the process within seconds
• A handful of encrypted files were restored from local cache automatically
• A clean restore point from day 55 (before the triggering, inside the 120-day window) was available in Acronis Cloud, immutable and intact
• Recovery time: hours, not weeks. No CAD files lost. Microsoft 365 email covered and intact.

The previous setup would have failed at three of the four tests: no test restore had ever been run, the backup drive was not isolated, and the 14-day retention was well inside the dormancy window.

Final Recommendation

Check current Acronis Cyber Protect pricing →

If your business depends on its data to operate daily, your backup needs to pass all four tests: a verified restore, isolated storage, full data coverage, and 90-plus days of retention. Most hosting backups fail at least two.

For businesses without dedicated IT staff that need reliable ransomware protection without building a complex multi-tool stack, Acronis Cyber Protect covers all four requirements in one platform.

If your business has fewer than five employees, your data is minimal, and you can genuinely tolerate 48 hours of downtime, a simpler solution may be sufficient — but understand you are accepting a higher recovery risk.

For everyone else: the cost of Acronis is a fixed monthly expense. The cost of recovering without it is unpredictable and frequently much larger.

• Small Business Backup and DR with Acronis: The Complete Guide — how to build a complete backup and recovery plan using Acronis
• 5 Signs Your Hosting Backup Won't Survive Ransomware — specific failure modes in standard hosting backups
• Small Business Continuity Guide