7 Backup Mistakes Companies still making in 2025

1. Assuming All Data is Equally Important

Treating every dataset as equally important is the most common starting error. It wastes resources on data nobody would rush to restore, and it leaves the data they would rush to restore competing for the same window.

The Problem

When organizations fail to differentiate between their data assets, they create inefficiencies and vulnerabilities that affect both operational capacity and recovery capabilities:

• Application-based prioritization gaps : Critical enterprise applications like ERP systems, CRM databases, and financial platforms require more robust backup protocols than departmental file shares or development environments. Without application-specific backup policies, mission-critical systems often receive inadequate protection while less important applications consume excessive resources.
• Infrastructure complexity : Today’s hybrid environments span on-premises servers, private clouds, and SaaS platforms. Each infrastructure component requires tailored backup approaches. Applying a standard backup methodology across these diverse environments results in protection gaps for specialized platforms.
• Resource misallocation : Backing up rarely-accessed documents with the same frequency as mission-critical databases wastes storage, bandwidth, and processing resources, often leading to overprovisioned backup infrastructure.
• Extended backup windows : Without prioritization, critical systems may wait in queue behind low-value data, increasing the vulnerability period for essential information as total data volumes grow.
• Delayed recovery : During disaster recovery, trying to restore everything simultaneously slows down the return of business-critical functions. IT teams waste precious time restoring non-essential systems while revenue-generating applications remain offline.
• Compliance exposure : Industry-specific requirements for protecting and retaining data types are overlooked in blanket approaches, creating regulatory vulnerabilities.

The approach looks simpler at the outset. The cost turns up later, in overprovisioned storage and in recoveries that take longer than they need to.

The Solution

Classify the data, then match backup policy to how much each application matters:

• Critical business applications : Core enterprise systems like ERP, CRM, financial platforms, and e-commerce infrastructure should receive the highest backup frequency (often continuous protection), with multiple copies stored in different locations using immutable backup technology.
• Database environments : Production databases require transaction-consistent backups with point-in-time recovery capabilities and shorter recovery point objectives (RPOs) than static file data.
• Infrastructure systems : Directory services, authentication systems, and network configuration data need specialized backup approaches that capture system state and configuration details.
• Operational data : Departmental applications, file shares, and communication platforms require daily backups but may tolerate longer recovery times.
• Development environments : Test servers, code repositories, and non-production systems can use less frequent backups with longer retention cycles.
• Reference and archived data : Historical records and rarely accessed information can be backed up less frequently to more cost-effective storage tiers.

By aligning backup methodologies with application importance and infrastructure components, you can allocate resources more effectively and ensure faster recovery of business-critical systems when incidents occur. For application-aware protection, see how DPX applies different levels to different application types.

2. Failing to Test Backups Regularly

A backup nobody has restored is an assumption rather than a safeguard. Testing is what turns it into something you can rely on, and it is the step most often skipped, because nothing looks wrong until the day it matters.

The Problem

Untested backups frequently fail during actual recovery situations for reasons that could have been identified and remediated through proper testing:

• Silent corruption : Data degradation can occur gradually within backup media or files without triggering alerts. This bit rot often remains undetected until restoration is attempted, when critical files prove to be unreadable.
• Incomplete application backups : Modern applications consist of several moving parts: the database, configuration files, dependencies, and state information. Without testing, organizations often discover they’ve backed up the database but missed configuration files needed for the application to function.
• Missing interdependencies : Enterprise systems rarely exist in isolation. When testing is limited to individual systems rather than interconnected environments, recovery efforts can fail because related systems aren’t restored in the correct sequence or configuration.
• Outdated recovery documentation : System environments evolve continuously through updates, patches, and configuration changes. Without regular testing to validate and update documentation, recovery procedures become obsolete and ineffective during actual incidents.
• Authentication and permission issues : Backup systems often require specific credentials and permissions that may expire or become invalid over time. These access problems typically only surface during restoration attempts.
• Recovery performance gaps : Without testing, organizations cannot accurately predict how long restoration will take. A recovery process that requires 48 hours when the business continuity plan allows for only 4 hours represents a critical failure, even if the data is eventually restored.
• Incompatible infrastructure : Recovery often occurs on replacement hardware or cloud infrastructure that differs from production environments. These compatibility issues only become apparent during actual restoration attempts.
• Human procedural errors : Recovery processes frequently involve complex, manual steps performed under pressure. Without practice through regular testing, technical teams make avoidable mistakes during critical recovery situations.

What makes this one damaging is that the problems stay invisible until a real incident, by which point the organisation is already in crisis mode and the cost of a failed backup is far higher. IBM’s Cost of a Data Breach Report put the 2025 global average at USD 4.44 million, down 9% year on year and the first fall in five years, which IBM credits largely to faster identification and containment. The direction of travel is not uniform, though: the average for US organisations rose to USD 10.22 million. How long recovery takes is one of the few levers that moves either number.

The Solution

Run a scheduled testing regimen covering both the technical integrity of the backups and your team’s readiness to use them:

• Scheduled full-system recovery tests : Conduct quarterly end-to-end restoration tests of critical business applications in isolated environments. These tests should include all components needed for the system to function properly—databases, application servers, authentication services, and network components.
• Recovery Time Objective (RTO) validation : Measure and document how long each recovery process takes, comparing actual results against business requirements. Identify and address performance bottlenecks that extend recovery beyond acceptable timeframes.
• Recovery Point Objective (RPO) verification : Confirm that the most recent available backup meets business requirements for data currency. If systems require no more than 15 minutes of data loss but testing reveals 4-hour gaps, adjust backup frequency accordingly.
• Application functionality testing : After restoration, verify that applications actually work correctly, not just that files were recovered. Test business processes end-to-end, including authentication, integrations with other systems, and data integrity.
• Regular sample restoration : Perform monthly random-sample restoration tests across different data types and systems. These limited tests can identify issues without the resource requirements of full-system testing.
• Scenario-based testing : Annually conduct disaster recovery exercises based on realistic scenarios like ransomware attacks, datacenter outages, or regional disasters. These tests should involve cross-functional teams, not just IT personnel.
• Automated verification : Use tooling that checks backup integrity and confirms recoverability without running a full restore. DPX provides this for Block and VMware backups written to a vStor destination. Enable it per job, and vStor mounts the backup snapshot as a volume to confirm the data is readable, after which GuardMode can optionally scan the mounted copy for malware. Snapshots on ReFS, Btrfs, or LVM cannot be mounted this way. See the DPX 4.13 backup verification introduction and the backup verification documentation.
• Documentation reviews : After each test, update recovery documentation to reflect current environments, procedures, and lessons learned. Ensure these procedures are accessible during crisis situations when normal systems may be unavailable.
• Staff rotation during testing : Involve different team members in recovery testing to build organizational depth and ensure recovery isn’t dependent on specific individuals who might be unavailable during an actual disaster.

Backup testing belongs in business continuity planning with the same standing as any other continuity control. What decides the outcome of a crisis is a recovery you have already performed at least once, under conditions close enough to the real thing to be worth something. For guidance on implementing testing procedures aligned with industry standards, consult the NIST Cybersecurity Framework, which offers best practices for data security and recovery testing.

3. Not Having an Offsite Backup Strategy

Physical separation between production systems and backup storage is what stops one local event from taking the copy along with the original. Distance is the whole mechanism, and it is the part most often compromised for convenience.

The Problem

When backups remain onsite, numerous threats can compromise both your primary data and its backup simultaneously, creating a catastrophic single point of failure:

• Storm and flood devastation : Extreme weather events like Hurricane Sandy in 2012 demonstrated how vulnerable centralized data storage can be. Many data centers in Lower Manhattan failed despite elaborate backup power systems and continuity processes, with some staying offline for days. When facilities like Peer 1’s data center in New York were flooded, both their primary systems and backup generators were compromised when basement fuel reserves and pumps were submerged.
• Rising climate-related disasters : Climate change is increasing the frequency of natural disasters, forcing administrators to address disaster possibilities they might not have invested resources in before, including wildfires, blizzards, and power grid failures. The historical approach of only planning for familiar local weather patterns is no longer sufficient.
• Fire and structural damage : A fire can take out every system in a building at once, and it does not have to reach the racks to do it. When one broke out in a network room at a BT facility in Belfast, firefighters cut power to the entire data centre on arrival. The hardware was undamaged and customers were still offline the following morning.
• Cascading infrastructure failures : During Hurricane Sandy, New York City experienced widespread outages that revealed unexpected vulnerabilities. Some facilities lost power when their emergency generator fuel pumping systems were knocked out, causing the generators to run out of fuel. This created a cascading failure that affected both primary and backup systems.
• Ransomware and malicious attacks : Modern ransomware specifically targets backup systems connected to production networks. When backup servers are on the same network as primary systems, a single security breach can encrypt or corrupt both production and backup data simultaneously.
• Physical security breaches : Theft, vandalism, or sabotage at a single location can impact all systems housed there. Even with strong security measures, having all assets in one location creates a potential vulnerability that determined attackers can exploit.
• Regional service disruptions : Events like Superstorm Sandy cause damage and problems far beyond their immediate path. Some facilities in the Midwest experienced construction delays as equipment and material deliveries were diverted to affected sites on the East Coast. These ripple effects demonstrate how regional disasters can have wider impacts than anticipated.
• Restoration logistical challenges : When disaster affects your physical location, staff may be unable to reach the facility due to road closures, transportation disruptions, or evacuation orders. Sandy created regional problems where travel was limited across large areas due to fallen trees and gasoline shortages, restricting the movement of staff and supplies.

Even organizations that implement onsite backup solutions with redundant hardware and power systems remain vulnerable if a single catastrophic event can affect both primary and backup systems simultaneously. The history of data center disasters is filled with cautionary tales of companies that thought their onsite redundancy was sufficient until a major event proved otherwise.

The Solution

Build an offsite strategy with real geographical separation:

• Follow the 3-2-1-1 rule : Maintain at least three copies of your data (production plus two backups), on two different media types, with one copy offsite, and one copy offline or immutable. This approach provides multiple layers of protection against different disaster scenarios.
• Use cloud-based backup solutions : Cloud storage offers immediate offsite protection without the capital expense of building a secondary facility. Major cloud providers maintain data centers in multiple regions specifically designed to survive regional disasters, often with better physical security and infrastructure than most private companies can afford.
• Implement site replication for critical systems : For mission-critical applications with minimal allowable downtime, consider full environment replication to a geographically distant secondary site. This approach provides both offsite data protection and rapid recovery capability by maintaining standby systems ready to take over operations.
• Ensure physical separation from local disasters : When selecting offsite locations, analyze regional disaster patterns to ensure adequate separation from shared risks. Your secondary location should be on different power grids, water systems, telecommunications networks, and far enough away to avoid being affected by the same natural disaster.
• Consider data sovereignty requirements : For international organizations, incorporate data residency requirements into your offsite strategy. Some regulations require data to remain within specific geographical boundaries, necessitating careful planning of offsite locations.
• Keep air-gapped or immutable copies : Against ransomware that hunts backups, keep copies either disconnected from production networks or held in immutable backup storage that cannot be altered once written, even by an administrator. Secure immutable backup on-prem covers how that works without a cloud dependency.
• Automate offsite replication : Configure automated, scheduled data transfers to offsite locations with monitoring and alerting for any failures. Manual processes are vulnerable to human error and oversight, especially during crisis situations.
• Validate offsite recovery capabilities : Regularly test the ability to restore systems from offsite backups under realistic disaster scenarios. Document the processes, timing, and resources required for full recovery from the offsite location.

By implementing a true offsite backup strategy with appropriate geographical diversity, organizations create resilience against localized disasters and significantly improve their ability to recover from catastrophic events. The investment in offsite protection is minimal compared to the potential extinction-level business impact of losing both primary and backup systems simultaneously. For specialized cloud backup solutions, explore Catalogic’s CloudCasa for protecting cloud workloads with secure offsite storage.

4. Relying Solely on One Backup Method

Relying on one backup method, whether that is cloud storage, a local NAS, or tape, leaves nothing to fall back on when it fails.

The Problem

Each backup method has inherent vulnerabilities:

• Cloud backups depend on internet connectivity and service provider reliability
• Local storage devices can fail or become corrupted
• Manual backup processes are subject to human error
• Automated systems can experience configuration issues or software bugs

When you rely on just one approach, a single point of failure can leave your business without recourse.

The Solution

Spread the risk across methods:

• Combine automated and manual backup procedures
• Utilize both local and cloud backup solutions
• Consider maintaining some offline backups for critical data
• Use different vendors or technologies to avoid common failure modes
• Ensure each system operates independently enough that failure of one doesn’t compromise others

Layering protection reduces the chance that one technical failure, one mistake, or one breach leaves you with nothing to recover from. The value lies in the failure modes being genuinely different: whatever takes out a network-attached copy will usually leave a tape in a vault untouched.

Example Implementations

Implementation 1: Small Business Hybrid Approach

Components:

• Daily automated backups to a local NAS device
• Cloud backup service with different timing (nightly)
• Quarterly manual backups to external drives stored in a fireproof safe
• Annual full system image stored offline in a secure location

How it works: A small accounting firm implements this layered approach to protect client financial data. Their NAS device provides fast local recovery for everyday file deletions or corruptions. The cloud backup through a service like Backblaze or Carbonite runs on a different schedule, creating time diversity in their backups. Quarterly, the IT manager creates complete backups on portable drives kept in a fireproof safe, and once a year, they create a complete system image stored at the owner’s home in a different part of town. This approach ensures that even if ransomware encrypts both the production systems and the NAS (which is on the same network), the firm still has offline backups available for recovery.

Implementation 2: Enterprise 3-2-1-1 Strategy

Components:

• Production data on primary storage systems
• Second copy on local disk-based backup appliance with deduplication
• Third copy replicated to cloud storage provider
• Fourth immutable copy using cloud object lock technology (WORM storage)

How it works: A mid-sized healthcare organization maintains patient records in their electronic health record system. Their primary backup is to a purpose-built backup appliance (PBBA) that provides fast local recovery. This system replicates nightly to a cloud service using a different vendor than their primary cloud provider, creating vendor diversity. Additionally, they implement immutable storage for their cloud backups using Amazon S3 Object Lock or Azure Blob immutable storage, ensuring that even if an administrator’s credentials are compromised, backups cannot be deleted or altered. The immutable copy meets compliance requirements and provides ultimate protection against sophisticated ransomware attacks that specifically target backup systems.

Implementation 3: Mixed Media Manufacturing Environment

Components:

• Virtual server backups to purpose-built backup appliance
• Physical server backups to separate storage system
• Critical database transaction logs shipped to cloud storage every 15 minutes
• Monthly full backups to tape library with tapes stored offsite
• Annual system-state backups to write-once optical media

How it works: A manufacturing company with both physical and virtual servers creates technology diversity by using different backup methods for different system types. Their virtual environment is backed up using snapshots and replication to a dedicated backup appliance, while physical servers use agent-based backup software to a separate storage target. Critical database transaction logs are continuously shipped to cloud storage to minimize data loss for financial systems. Monthly, full backups are written to tape and stored with a specialised records management company, and annual compliance backups go to Blu-ray optical media that cannot be altered once written. Retention over that kind of horizon is its own discipline, covered under long-term retention and archival. No single technology failure can compromise all of their backups at once.

5. Neglecting Encryption for Backup Data

Many businesses that carefully encrypt their production data fail to apply the same security standards to their backups, creating a potential security gap.

The Problem

Unencrypted backups present serious security risks:

• Backup data often contains the most sensitive information a business possesses
• Backup files may be transported or stored in less secure environments
• Theft of backup media can lead to data breaches even when production systems remain secure
• Regulatory compliance often requires protection of data throughout its lifecycle

In many data breach cases, attackers target backup systems specifically because they know these often have weaker security controls.

The Solution

Hold backups to the same encryption standard as production:

• Use strong encryption for all backup data, both in transit and at rest
• Manage encryption keys securely and separately from the data they protect
• Ensure that cloud backup providers offer end-to-end encryption
• Verify that encrypted backups can be successfully restored
• Include backup encryption in your security audit processes

Encryption means that compromised media or files still yield nothing usable. vStor 4.15 added KMIP-based key management with keystore configuration and migration workflows, and DPX 4.15 added client-side encryption for agentless VMware archive jobs written to a cloud or S3 target. Both are covered in what DPX 4.15 actually delivers. For advanced ransomware protection strategies, refer to Catalogic’s Ransomware Protection Guide which details how encryption helps safeguard backups from modern threats.

6. Setting and Forgetting Backup Systems

One of the most insidious backup mistakes is configuring a backup system once and then assuming it will continue functioning indefinitely without supervision.

The Problem

Unmonitored backup systems frequently fail silently, creating a false sense of security while leaving businesses vulnerable. This “set it and forget it” mentality introduces numerous risks that compound over time:

• Storage capacity limitations : As data grows, backup storage eventually fills up, causing backups to fail or only capture partial data. Many backup systems don’t prominently display warnings when approaching capacity limits.
• Configuration drift : Over time, production environments evolve with new servers, applications, and data sources. Without regular reviews, backup systems continue protecting outdated infrastructure while missing critical new assets.
• Failed backup jobs : Intermittent network issues, permission changes, or resource constraints can cause backup jobs to fail occasionally. Without active monitoring, these occasional failures can become persistent problems.
• Software compatibility issues : Operating system updates, security patches, and application upgrades can break compatibility with backup agents or backup software versions. These mismatches often manifest as incomplete or corrupted backups.
• Credential and access problems : Expired passwords, revoked API keys, changed service accounts, or modified security policies can prevent backup systems from accessing data sources. These authentication failures frequently go unnoticed until recovery attempts.
• Gradual corruption : Bit rot, filesystem errors, and media degradation can slowly corrupt backup repositories. Without verification procedures, this corruption spreads through your backup history, potentially invalidating months of backups.
• Evolving security threats : Backup systems configured years ago often lack modern security controls, leaving them exposed to ransomware that goes after backup repositories first. GuardMode exists to catch that class of attack against the backup estate itself.
• Outdated recovery procedures : As systems change, documented recovery procedures become obsolete. Technical staff may transition to new roles, leaving gaps in institutional knowledge about restoration processes.

These issues usually surface during an attempted recovery, which is exactly too late. The resulting downtime and permanent data loss carry both financial and reputational cost.

The Solution

Treat the backup system as monitored infrastructure:

• Establish automated alerting for backup failures or warnings
• Conduct weekly reviews of backup logs and status reports
• Schedule quarterly audits of your entire backup infrastructure
• Update backup systems and procedures when production environments change
• Assign clear responsibility for backup monitoring to specific team members

Treating backup systems as critical infrastructure that requires ongoing attention will help ensure they function reliably when needed.

7. Not Knowing Where All Data Resides

The modern enterprise data landscape has expanded far beyond traditional data centers and servers. Today’s distributed computing environment creates a complex web of data storage locations that most organizations struggle to fully identify and protect.

The Problem

Businesses often fail to back up important data because they lack any real inventory of where information is created, processed, and stored across their technology ecosystem:

• Shadow IT proliferation : Departments and employees frequently deploy unauthorized applications, cloud services, and technologies without IT oversight. End users may not understand the importance of security controls for these assets, and sensitive data stored in shadow IT applications is typically missed during backups of officially sanctioned resources, making it impossible to recover after data loss. Netskope’s cloud and threat research puts the average enterprise at roughly 1,300 apps and cloud services, the overwhelming majority adopted by teams and individuals rather than provisioned by IT.
• Incomplete SaaS application protection : Critical business information in cloud-based platforms like Salesforce, Microsoft 365, Google Workspace, and thousands of specialized SaaS applications isn’t automatically backed up by the vendors. Most SaaS providers operate under a shared responsibility model where they protect the infrastructure but customers remain responsible for backing up their own data.
• Distributed endpoint data : With remote and hybrid work policies, critical business information now resides on employee laptops, tablets, and smartphones scattered across home offices and other locations. Many organizations lack centralized backup solutions for these endpoints, especially personally-owned devices used for work purposes.
• Isolated departmental solutions : Business units often implement specialized applications for their specific needs without coordinating with IT, creating data silos that remain invisible to corporate backup systems. For example, marketing teams may use campaign management platforms, sales departments may deploy CRM tools, and engineering teams may utilize specialized development environments, each containing business-critical data.
• Untracked legacy systems : Older applications and databases that remain operational despite being officially decommissioned or replaced often contain historical data that’s still referenced occasionally. These systems frequently fall outside standard backup processes because they’re no longer in the official IT inventory.
• Development and testing environments : While not production systems, these environments often contain copies of sensitive data used for testing. Development teams frequently refresh this data from production but rarely implement proper backup strategies for these environments, risking potential compliance violations and intellectual property loss.
• Embedded systems and IoT devices : Manufacturing equipment, medical devices, security systems, and countless other specialized hardware often stores and processes valuable data locally, yet these systems are rarely included in enterprise backup strategies due to their specialized nature and physical distribution.
• Third-party partner access : Business partners, contractors, and service providers may have copies of your company data in their systems. Without proper contractual requirements and verification processes, this data may lack appropriate protection, creating significant blind spots in your overall data resilience strategy.

The fundamental problem is that organizations cannot protect what they don’t know exists. Traditional IT asset management practices have failed to keep pace with the explosion of technologies across the enterprise, leaving critical gaps in backup coverage that only become apparent when recovery is needed and the data isn’t available.

The Solution

Find the data first, then govern it with a maintained asset inventory:

• Conduct thorough enterprise-wide data mapping : Perform regular discovery of all IT assets across your organization using both automated tools and manual processes. An asset inventory worth the name covers hardware, software, devices, cloud environments, IoT devices, and all data repositories regardless of location. The focus should be on everything that could have exposures and risks, whether on-premises, in the cloud, or co-located.
• Implement continuous asset discovery : Deploy tools that continuously monitor your environment for new assets rather than relying on periodic manual audits. An effective IT asset inventory should leverage real-time data to safeguard inventory assets by detecting potential vulnerabilities and active threats. This continuous discovery approach is particularly important for identifying shadow IT resources.
• Establish a formal IT asset management program : Create dedicated roles and processes for maintaining your IT asset inventory. Without clearly defining what constitutes an asset, organizations run the risk of allowing shadow IT to compromise operations. Your inventory program should include specific procedures for registering, tracking, and decommissioning all technology assets.
• Extend inventory to third-party relationships : Document all vendor and partner relationships that involve access to company data. The current digital landscape’s proliferation of internet-connected assets and shadow IT poses significant challenges for asset inventory management. Require third parties to provide evidence of their backup and security controls as part of your vendor management process.
• Create data classification frameworks : Categorize data based on its importance, sensitivity, and regulatory requirements to prioritize backup and protection strategies. Managing IT assets is a critical task that requires defining objectives, establishing team responsibilities, and ensuring data integrity through backup and recovery strategies.
• Implement centralized endpoint backup : Deploy solutions that automatically back up data on laptops, desktops, and mobile devices regardless of location. These solutions should work effectively over limited bandwidth connections and respect user privacy while ensuring business data is protected.
• Adopt specialized SaaS backup solutions : Implement purpose-built backup tools for major SaaS platforms like Microsoft 365, Salesforce, and Google Workspace. Data stored in shadow IT applications will not be caught during backups of officially sanctioned IT resources, making it hard to recover information after data loss.
• Leverage cloud access security brokers (CASBs) : Deploy technologies that can discover shadow cloud services and enforce security policies including backup requirements. CASBs can discover shadow cloud services and subject them to security measures like encryption, access control policies and malware detection.
• Educate employees on data management policies : Create clear guidelines about approved technology usage and data storage locations, along with the risks associated with shadow IT. Implement regular training to help staff understand their responsibilities regarding data protection.

By creating and maintaining a comprehensive inventory of all technology assets and data repositories, organizations can significantly reduce their blind spots and ensure that backup strategies encompass all business-critical information, regardless of where it resides. An accurate, up-to-date asset inventory ensures your company can identify technology gaps and refresh cycles, which is essential for maintaining effective backup coverage as your technology landscape evolves.

Building a Resilient Backup Strategy

Avoiding these seven mistakes gets you to a materially more resilient position. Backup strategies also age: they need revisiting as the business grows, as the estate changes, and as the threats move on.

Consider working with data protection specialists to evaluate your current backup approach and identify specific improvements. The investment in proper backup systems is minimal compared to the potential cost of extended downtime or permanent data loss.

Above all, give data backup executive ownership. Where leadership understands and funds data protection properly, the resilience tends to follow; where it is left to IT to argue for, it usually does not.

If you want a second opinion on where your own strategy sits against this list, request a demo and we will walk through it against a real environment.