KNP was a 158-year-old logistics company in Northamptonshire, England. When hackers from the Akira ransomware gang guessed an employee’s weak password, they encrypted the company’s data and locked its internal systems. KNP paid the ransom. The attackers never restored access. The company entered administration and ceased trading. Nearly 700 people lost their jobs.
KNP had IT compliance with industry standards. They had cyber insurance. They reportedly had backups. None of it mattered because they had no tested business continuity plan. They could not resume operations. The economics of recovery simply did not work.
This is not an isolated case. It is the predictable result of a mistake most business owners make: treating backup as a synonym for business continuity. They are not the same thing. And the gap between them is where companies die.
What Backup Actually Is
Backup is a copy of your data. That is it. A snapshot stored on a disk, in the cloud, or on a tape. It is a necessary component of any IT strategy, but it is only one component.
Think of backup like a spare tire in your trunk. Having one is better than not having one. But if you do not know how to change it, if the spare is flat, or if you are stranded on a highway with no shoulder, the spare tire alone does not get you home.
According to the At-Bay 2025 InsurSec Report, 92% of businesses report having backups, yet 31% fail to restore data from them during a ransomware attack. The backup exists. The recovery does not work.
What Business Continuity Actually Is
Business continuity is the strategy that keeps your company operating during and after a disruption. It encompasses backup, but it also includes:
- Recovery Time Objective (RTO): How long can you afford to be offline?
- Recovery Point Objective (RPO): How much data can you afford to lose?
- Failover systems: Can your operations run from a secondary location or cloud environment while primary systems are restored?
- Communication plans: Who notifies customers, vendors, and employees when systems go down?
- Documented procedures: Does your team know exactly what to do, in what order, when disaster strikes?
- Regular testing: Have you actually verified that your backups restore successfully and your failover works?
As Datto puts it: “Backup is the process of creating copies of your data, systems and configurations so you can recover them if they are lost, deleted or damaged. Business continuity is the strategy and planning that ensures your business can continue operating during and after an unexpected event.”
Backup is a noun. Business continuity is a practice.
The Numbers Tell the Story
The gap between having a backup and having business continuity is not theoretical. It is measured in bankruptcies.
| Statistic | Source |
|---|---|
| 40% of small businesses never reopen after a disaster | FEMA / WifiTalents 2026 |
| 60% of small businesses close within 6 months of a significant data loss event | Cybersecurity Ventures |
| 93% of companies losing data center access for 10+ days file for bankruptcy within 1 year | Invenio IT / WifiTalents 2026 |
| 52% of small businesses say recovery takes at least 3 months | WifiTalents 2026 |
| Only 26% of companies have a formal disaster recovery plan | U.S. Chamber of Commerce |
| 15% of businesses have never tested their DR plan | WifiTalents 2026 |
| 50% of companies with critical failure and no DR plan never recover | WifiTalents 2026 |
| 50% of all tape backups fail to restore | WifiTalents 2026 |
| 75% of SMBs say they could not continue operating if hit with ransomware | BD Emerson |
| Average ransomware downtime: 24 days | Invenio IT |
The CrashPlan 2026 data loss report found that 67.7% of businesses experienced significant data loss in the past year, yet only 40% of IT professionals feel confident their backup solutions could actually protect critical assets during an incident. That confidence gap is where KNP ended up.
Why Backups Fail When You Need Them Most
There are predictable reasons backups do not save companies during real incidents:
1. Backups are not tested. A backup that has never been restored is an assumption, not a plan. The WifiTalents 2026 report found that 30% of organizations never check backup integrity. You do not know if your backup works until you try to restore it. By then, it may be too late.
2. Ransomware encrypts backups too. Modern ransomware does not just target production systems. It actively seeks out and encrypts backup repositories. If your backups are on the same network as your production data, they are part of the attack surface. The At-Bay report documented a small tech firm hit with a $600K ransomware demand where “their operations came to a screeching halt, and their backups were compromised.”
3. Recovery takes longer than you think. Even when backups are intact, restoring a full environment takes time. Hours. Days. Weeks. During that time, your business is not operating. Your customers are calling your competitors. Your employees are sitting idle. Your revenue is zero. The average cost of IT downtime is $5,600 per minute according to WifiTalents. For small businesses, that is $8,500 per hour.
4. You are missing critical systems. Many businesses back up file servers and email but forget about line-of-business applications, phone systems, access control, and specialized databases. When you restore from backup, you discover that the application that runs your entire operation was never included in the backup scope.
What a Competent IT Provider Does
If your IT provider tells you that you are “backed up” and leaves it at that, they are doing half the job. Here is what real business continuity looks like from a competent provider:
They define your RTO and RPO. Every system in your business has a different tolerance for downtime and data loss. Your email system might tolerate four hours of downtime. Your order processing system might tolerate fifteen minutes. A competent provider maps every critical system to specific recovery objectives and builds the infrastructure to meet them.
They test recovery regularly. Not annually. Quarterly at minimum. They restore backups to an isolated environment and verify that systems actually boot, applications actually run, and data is actually intact. They document the results. They share them with you.
They maintain offline and offsite backups. Backups that are air-gapped or stored in immutable cloud storage cannot be encrypted by ransomware that has compromised your network. This is not optional in 2026. It is the baseline.
They document the recovery plan. Every step. Every system. Every dependency. In writing. Stored in a location that is accessible even when your primary systems are down. If your IT provider cannot hand you a printed recovery plan, you do not have one.
They conduct tabletop exercises. A tabletop exercise walks through a disaster scenario step by step. What happens first? Who does what? Who calls the customers? Who contacts the insurance carrier? These exercises reveal gaps in the plan before a real disaster exposes them.
Questions to Ask Your IT Provider
If you are evaluating your current provider or shopping for a new one, ask these questions directly:
- “What is my Recovery Time Objective for each critical system, and what infrastructure is in place to meet it?”
- “When was the last time you performed a full recovery test? Can I see the results?”
- “Are my backups stored offline or in immutable storage that ransomware cannot encrypt?”
- “Do you have a documented business continuity and disaster recovery plan for my company? Can I have a copy?”
- “Which of my systems are NOT included in the backup scope, and what is the plan for those?”
- “How long would it take to restore my full environment from backup, and what would my operations look like during that time?”
- “When did we last conduct a tabletop exercise for a ransomware scenario?”
If your provider cannot answer these questions clearly and specifically, you have a backup. You do not have business continuity.
The Bottom Line
KNP had been in business since 1865. They survived two world wars, the Great Depression, and a global pandemic. They did not survive a single guessed password because they had no operational resilience beyond a backup copy.
Backup is necessary. It is not sufficient. Business continuity is the difference between a bad week and a permanent closure. Ask your provider the hard questions now, while you still have time to fix the answers.
Frequently Asked Questions
What is the difference between backup and business continuity?
Backup is a copy of your data. Business continuity is the comprehensive strategy that keeps your company operating during and after a disruption. Backup is one component of business continuity, but it does not include failover systems, recovery procedures, communication plans, or regular testing.
How often should backups be tested for recovery?
At minimum, quarterly. A backup that has never been restored is an assumption, not a guarantee. Regular recovery testing verifies that backups are intact, systems actually boot, and data is usable.
Can ransomware encrypt my backups?
Yes. Modern ransomware actively targets backup repositories. If your backups are on the same network as your production data, they are vulnerable. Competent providers maintain offline or immutable cloud backups that cannot be encrypted by network-based attacks.
What are RTO and RPO?
Recovery Time Objective (RTO) is the maximum time your business can afford to be offline. Recovery Point Objective (RPO) is the maximum amount of data you can afford to lose. These metrics should be defined for every critical system in your business.
How many businesses fail after a disaster?
According to FEMA, 40% of small businesses never reopen after a disaster. Cybersecurity Ventures reports that 60% of small businesses close within 6 months of a significant data loss event. Companies that lose data center access for 10 or more days face a 93% bankruptcy rate within one year.
About the Author
Brent Lacy has spent over 20 years in the IT services industry, building and advising MSPs across the country. He is the author of Rewired MSP: Mastery, Scalability & Performance, vCIO Rewired: Virtually Conquering IT Obstacles, and Near Miss: Preventable IT Failures Threatening Your Business Security. His work focuses on operational excellence, trust-based client relationships, and the business discipline that separates surviving MSPs from thriving ones.
Related Articles
