CYBCybersecurity

The missing piece: why backup is not enough without prevention and detection

Backup repairs damage that has already been done. It does not stop anyone getting in, and it does not tell you who did. Here are the three pillars of basic defence, and the quarterly review to run with IT and management.

Strategic editorial team 22 April 2026 7 min read

Cover: “Backup, prevention, detection: the missing piece”, Cybersecurity

Backup is essential, but on its own it does not protect a company. It repairs damage that has already happened. It does not stop anyone getting in, and it does not warn you when someone has. Basic defence rests on three pillars that work together. Prevention makes getting in difficult. Detection spots, in time, anyone who has managed to get in. Backup lets you start again. If one is missing, the other two deliver less. A quarterly review, run by IT with someone from management, is enough to tell whether all three are holding up.

Why is backup alone not enough?

“We have backups” is often the first answer when security comes up, and that is good news. But a company with nothing except backup is like a house with nothing except burglary insurance. After the break-in, a payout arrives. Nobody gives you back the broken window, the lost days or your customers’ trust.

In practice, backup leaves at least four situations uncovered.

Data theft. Many attacks now copy information before encrypting it, and then threaten to publish it. Backup brings the files back, but it cannot recall data that has already left.
Attacks on the backups. According to Mandiant’s M-Trends 2026 report, published in March 2026, several ransomware groups targeted backup infrastructure itself in 2025. Some went as far as deleting copies kept in the cloud, to take away their victims’ ability to recover.
The door left open. If the attacker planted hidden access before the backup was taken, restoring it brings that access back to life as well.
Time. Restoring whole systems takes hours or days, and meanwhile the company runs at half speed.

That is why backup should be treated as the last pillar, not the only one. How to build backups that hold up (several copies, different media, one copy kept separate) is the subject of our article on Grandad’s backup.

What does prevention mean?

Prevention means making it expensive to get in. Most financially motivated attacks are automated and pick the easiest doors, as the imaginary letter from a reformed attacker explains. The measures that matter most are few.

Prioritised updates. Systems exposed to the internet come first, together with vulnerabilities that are known to be exploited.
Strong authentication. Use a second factor on email, remote access, cloud services and admin accounts. Use unique passwords, kept in a dedicated password manager, so you do not repeat the mistake of reused passwords.
Least privilege. Users work without administrator rights, and administrators use separate accounts.
A smaller attack surface. Management panels and remote access can be reached only by the people who need them.
Trained staff. Simple rules protect against the most common scams, such as the phone call from fake tech support.
Protection for computers. Use tools that watch for suspicious behaviour, not just known viruses, as our article on antivirus explains.

How do you know someone has got in?

That is the job of detection, the most neglected pillar. The same M-Trends report says that access stolen by one criminal group can now be handed to another within seconds. The time between entry and damage is shrinking. Whoever is inside can copy data, widen their access and hunt for the backups before anyone notices.

Detection does not mean watching everything. It means three things.

Collect the right logs. That means remote access, authentication, email, firewalls and critical systems. Keep the logs away from the servers they describe, as our article on Sherlock Holmes and the log files explains.
Choose a few useful alerts. Examples are a run of failed logins, a login from an unusual country, a new administrator, a protection switched off or a backup deleted.
Give every alert an owner who knows what to do, inside the company or at an outside service.

How do the three pillars fit together?

The most widely used reference framework is NIST’s Cybersecurity Framework 2.0, published in 2024. It organises security into six functions. They are Govern, Identify, Protect, Detect, Respond and Recover. The three pillars are the essential version of that framework.

Pillar	The question it answers	What you need	How you check it
Prevention	How hard is it to get in?	updates, second factor, least privilege, trained staff	external checks and penetration tests
Detection	Will we notice in time?	centralised logs, chosen alerts, someone responsible	a test alert and the response time
Backup	Can we restart, and from what point?	separate, protected copies and a restart order	a restore test with measured times

For companies in Italy subject to NIS2, the EU directive on network and information security, the three pillars match specific measures. The baseline specifications of Italy’s National Cybersecurity Agency (Agenzia per la Cybersicurezza Nazionale, ACN) require regular backups with offline copies for relevant systems. Essential entities must also run regular restore tests (measure PR.DS-11). The specifications require logging of remote and administrative access and secure retention of logs (PR.PS-04). They also require tools to detect significant incidents promptly (DE.CM-01).

The quarterly review: three checks with IT and management

Once every three months, set aside half a day with IT and someone from management. Run three checks, one per pillar, and write down the outcome.

1. Prevention: what has fallen behind?

The list of systems exposed to the internet, compared with the previous quarter’s list.
Pending updates, with the reason for each delay.
Admin accounts and remote access. Check who has them, who should no longer have them and where the second factor is missing.

2. Detection: do the alerts work?

A test event (for example a series of failed logins on a test account), and how long it takes for someone to notice.
Log sources that have stopped sending data.
Alerts from the last three months. Check how many there were, who handled them and with what outcome.

3. Backup: can you really restart?

A real restore, rotating between an archive, a mailbox and an entire server.
The time it took, compared with the maximum downtime management considers acceptable.
The separate copies. Do they exist, are they up to date, and are they protected from the people who run the everyday systems?

The outcome is a single page for management. It says what works, what does not, what will be done before the next quarter and who will do it.

When is outside help worth it?

When the same people build the systems and check them, it is easy to miss what has always been taken for granted. An outside view helps most at four moments. The first is when the review is set up for the first time. The second is after a major change, such as a new ERP system, a move to the cloud or an acquisition. The third is when a customer or an insurer asks for evidence. The fourth is when you want to test the recovery plan with an exercise.

In brief

Backup repairs damage that has happened. It does not stop the intrusion, does not report it and does not recall stolen data.
Prevention, detection and backup only work together.
Prevention means prioritised updates, a second factor, least privilege and trained staff.
Detection means logs kept elsewhere, a few useful alerts and an owner for each one.
Backup means separate, protected copies, tested with real restores and measured times.
A quarterly review with IT and management, with a written outcome, keeps all three pillars standing.

Frequently asked questions

If we have good backups, is ransomware a solved problem?

No. Backup lets you restart, but it does not prevent downtime. It does not protect you from data copied before encryption, and it can be attacked itself. You need it alongside prevention and detection.

What do you check in a restore test?

You check that the data really comes back readable, how long it takes and which steps are needed. Rotate the test across different items, from a single archive to an entire server. Then compare the time with the downtime the company can afford.

Who should take part in the quarterly review?

IT, whether in-house or external, should take part, together with someone from management who can decide on priorities and spending. When personal data is involved, it helps to bring in the data protection officer (DPO) as well.

Does detection need a dedicated team?

Not necessarily. Many companies start with centralised logs and a few alerts with an internal owner, and then grow step by step. What matters is that every alert has a person who receives it and a planned response.

Do the NIS2 measures require these checks?

For NIS entities in Italy, the ACN baseline specifications require backups with offline copies, logging and log retention, and detection tools. Essential entities must also run regular restore tests. For San Marino businesses the framework is different and has to be assessed case by case.

Three pillars, a calendar and a one-page outcome are the simplest way to know whether your defences hold. Strategic’s Cybersecurity division helps you set up the review, test prevention with penetration tests and prepare business continuity and recovery, with measured tests.

Sources

Consulted on 16 September 2026.

Find out moreCybersecurityTesting carried out the way an attacker would (penetration tests), incident management, business continuity and support in meeting NIS2 requirements, suppliers included.