Sometimes it’s the obvious that gets neglected. So, let’s talk about the obvious.
Whether it’s a ransomware attack, a benign deletion, or an AI agent getting a little too rambunctious, losing data is costly. It’s not only actual loss of data to be concerned about. For example, corruption (e.g., loss of integrity), regardless of reason or intent, can be costly too.
Think about it like this: if you are an AI developer, what happens when all your training data goes “poof” and disappears? Has your value proposition to the outside world just been shattered?
For many of us, we still treat data as our most valuable asset, which is a good baseline. That said, there is a strong case to be made that data is increasingly becoming a liability (but that’s a discussion for another time). This is why you often hear professionals and amateurs alike asking, “well do you have backups?”
An Incomplete Question
The question is valid, an excellent starting point. But depending on this question alone is where the neglect begins. Simply making and having backups is not enough. In fact, it barely scratches the surface. It’s the follow-on questions that need to be asked, and here are just some:
- Where are those backups located?
- Are backups accessible during crisis, even during the worst of scenarios?
- How are your backups protected?
- Have you validated the integrity of the backup?
- Have you validated your restoration time?
- Have you validated your assumptions?
- What type (e.g., differential, incremental) of backups do you have?
- Even if you have automatic backups running, do you really know how that process works and operates?
- Are your backups subject to some type of proprietary lock?
- Can you easily identify your last known true, clean, and valid set of data? (One of my favorites.)
- Do you employ a repeatable backup and testing methodology? (Another one of my favorites.)
Provenance and Poisoning
We all know the ransomware, extortion, and breach issues relatively well, but what about the new wave of challenges related to artificial intelligence? Models need data to be trained, but what happens when the data has been tampered with, lost, or becomes inaccessible?
The issue becomes a cascading one, particularly as AI adoption and dependence rates go up. And relatedly, you can build a strong case that bad data is far worse than a bad model. At least the model can be corrected, but can you be sure of data reliability and authenticity after an incident now? The question becomes much more difficult, which is why the issue of provenance comes into play. Where exactly did this data – or in this case, this backup – come from? If you cannot answer that question, there are downstream issues that await.
Can you Defend the Neglect v. the Expense?
If you have been tracking pricing trends for memory during Q1 of 2026, you may have noticed some eye-popping price tags and pushed-out delivery dates for hardware. Yes, memory has become more expensive, and for some, that is an unavoidable cost. The quest for rare earths and minerals is real, and virtually all our electronics depend on these raw material inputs.
But after reading this 55-second tidbit, can you afford the cost of not asking those additional questions? And be mindful, this is not an exhaustive list. The list of questions expands based on context. For example, if the response is, “our backups are in the cloud” then a line of question is:
- Are they all in the same availability zone? What happens if the entire AZ goes down?
- Oh, they’re in a different region. Okay, have you considered latency issues?
- Interesting, do you know how the backups are stored? Are they files? Objects? Blocks? Have you tested to see how that impacts download time?
- Got it but seems like a lot of data. But have you ever estimated the costs of pulling that data from the cloud? Can you afford the sticker shock of that bill, or will it mess up cash flow?
- Oh really? Insurance is paying for it, are you sure? Did you talk with your broker and carrier to check the policy language for sure? That “and” versus “or” and that stray comma may alter the interpretation.
- Have you ever considered offline, cold storage backups as a redundancy?
I don’t like to “doomsday” scenario. It gets overused and preys on emotions. #NotCool. But you must ask hard questions, and it is far easier to ask the questions ahead of time and not during the scramble. Even if you don’t have the answer today, you at least have the thought in mind, and act accordingly. And maybe you think through options and realize it’s a risk you’re willing to take.
So, I close with a quick tale of a mixed executive and technical wargame tabletop exercise I led. The organization took their work seriously and were a great group. Therefore, we tested their assumptions.
We knocked a few things over and got to the backup and restoration stage. They were confident in their procedures, methods, and vendors, but when tested (e.g., using some of the questions asked above), that eight-hour estimate recovery suddenly changed to three days. Eight hours is something management could live with; three days started to give them the sweats because now cash flow was starting to become an issue (and an interesting takeaway from the exercise was that this organization learned that up-to-a seven-day cash flow interruption could likely be weathered, but past that, it would get dicey). That was a great data point to learn not only about the technology, but about the business.
If you are looking to better understand if your data backup strategy is working well for you, reach out to me and let’s chat!