Backups restore slower than anyone tested

Restore drills usually test that a backup exists. They rarely test the full path: locate, decrypt, transfer, rehydrate, validate, cut over — under the network conditions of an actual incident.

In the cases we reviewed, measured recovery took between three and eleven times the stated objective. None of the organisations had run an end-to-end drill in the preceding year.