Backups are one of the first things businesses put in place, and rightly so.
They protect against:
- accidental deletion
- device failure
- ransomware
- lost or corrupted data
That’s all important, but there’s a gap that catches people out.
Backup protects data. It doesn’t protect access.
Most of the issues I see don’t start with data being deleted or encrypted.
They start with access.
A Microsoft 365 account is signed into by someone who shouldn’t be there.
From that point on, everything looks normal.
Emails are sent.
Files are opened.
Changes are made.
Nothing is “broken”.
What happens during account compromise
Once someone has access, they don’t usually rush.
They take their time.
Inbox rules are created
Emails are monitored or redirected
Conversations are followed
Opportunities are picked carefully
It can sit quietly in the background.
Days. Sometimes longer.
Where backup helps (and where it doesn’t)
Backup is still important.
If files are deleted, you can restore them.
If data is lost, you can recover it.
But backup doesn’t:
- stop someone logging in
- prevent emails being sent from your account
- stop impersonation or fraud
- alert you to unusual behaviour
- block access once it’s been granted
That’s the gap.
A common scenario
A phishing email is clicked.
Login details are entered.
MFA is approved.
Access is granted.
Nothing breaks.
No one notices.
A few days later, a supplier receives updated bank details.
Or a client gets an email that looks genuine.
Or something just feels off.
At that point, backup doesn’t fix the problem.
Because the issue isn’t data loss.
It’s trust, access and control.
This is why backup needs to sit in a wider setup
On its own, backup is a safety net. It reduces damage.
But it doesn’t reduce the likelihood of the issue happening in the first place.
To do that, you need visibility around:
- who is logging in
- what they’re doing
- what’s changed
- what doesn’t look right
What actually reduces the risk
This is where most businesses have a gap.
1. Visibility on Microsoft 365 accounts
Not just “is MFA on”
But:
- unusual login activity
- risky sessions
- new devices
- suspicious behaviour
Without that, access issues go unnoticed.
2. Better email protection
Reducing the number of phishing emails that land in inboxes removes a big chunk of risk before it even starts.
Less exposure
Fewer clicks
Fewer problems to deal with later
3. Monitoring on endpoints
If something is happening on a device, that needs to be picked up early.
Not after the fact.
4. Backup as part of the picture (not the whole picture)
Backup still matters.
It just needs to be seen for what it is: protection against loss, not protection against access
The difference is subtle, but important
A lot of businesses think:
“We’re covered, we’ve got backup”
In reality, that means:
“We can recover data if something happens”
Not:
“We can stop something happening”
Linking this back to phishing and MFA
If you’ve read this, it’s worth looking at what actually happens after a phishing click and why MFA doesn’t always stop it.
Because that’s where most of these situations begin.
If you’re relying on backup alone
You’re not alone.
Most businesses I speak to have done the right thing by putting backup in place.
It’s just one part of a bigger picture.
If you want to sense-check where you stand
A quick review usually highlights:
- where access could be exposed
- what’s visible (and what isn’t)
- how much reliance is placed on backup
- where the gaps actually are
Want a clearer view of where your cyber risk really sits?
If this feels familiar, a quick review can help highlight where the gaps are, what is already working, and what is worth improving next.
