Ask a small business owner whether they are backed up and you will almost always get a yes. Ask what would happen if the office burned down tonight, and the answer gets less confident.

Most small businesses are not unprotected. They are protected in a way that covers one failure mode — usually a hard drive dying — and leaves the others wide open. Here is how to tell the difference.

Sync Is Not Backup

This is the most common and most expensive misunderstanding.

Services like OneDrive, Dropbox and Google Drive sync your files. When a file changes on your computer, it changes in the cloud. That is enormously useful, and it is not a backup, because the sync faithfully copies the bad thing too.

Delete a folder by mistake and it disappears from the cloud. Get hit with ransomware and the encrypted versions sync up over the good ones. The mechanism doing the protecting is the same mechanism doing the damage.

Most of these services do keep version history, and it has saved plenty of businesses. But retention is often limited, restoring thousands of files to a point in time is genuinely painful, and it does not cover anything outside the synced folder.

The External Drive Problem

The second most common setup: a USB drive on a desk, either copied to manually or by a scheduled job.

It solves drive failure. It does not solve much else. It is plugged into the machine it is protecting, so ransomware encrypts it too. It is in the building, so fire, flood and theft take both copies. It is often years old, and nobody checks whether the job still runs — external drives fail at roughly the same rate as the ones they are backing up.

What a Real Backup Looks Like

The old rule still holds up. Three copies of your data, on two different types of media, with one of them offsite. For a modern small business that usually means:

  • The working copy on the computer.
  • A local backup for fast restores when someone deletes the wrong folder.
  • An offsite, encrypted copy in the cloud that cannot be altered by whatever happens on your network.

Two properties matter as much as the copies themselves:

Versioning. You need to restore to a point in time, not just to the latest state. Ransomware is often present for days before it encrypts anything. "The most recent backup" may already be compromised. Thirty days of recoverable versions is a reasonable floor.

Immutability. Backups that cannot be modified or deleted for a set period, even by an administrator account. This is what defeats attackers who go looking for the backups first — which is now standard practice, because they know it is the leverage.

Two Questions Nobody Asks Until It Is Too Late

How much work can you afford to lose? If backups run nightly and you are hit at 4pm, you lose a day. For some businesses that is an inconvenience. For a practice that booked forty appointments that day, it is not.

How long can you be down? Having the data is not the same as being operational. Restoring a full machine over a domestic internet connection can take days. If being down for three days would be fatal, your recovery plan needs to be faster than "download everything and hope."

Test It, Or You Do Not Have One

This is the part that separates businesses that recover from businesses that do not.

Backup jobs fail quietly. A drive fills up, credentials expire, a folder gets moved, an agent stops reporting. The job shows green because it is not running at all. Discovering this during a crisis is the single most common backup story there is.

Once a quarter, restore something real. Not a test file — an actual document from an actual backup, to a different machine, and open it. It takes fifteen minutes and it is the only way to know.

What Good Looks Like

Backups run automatically on every device, not just the server. They go offsite, encrypted, with version history. They cannot be deleted by anything that compromises your network. Someone checks that they actually completed. And somebody has restored from them recently enough to know the process works.

Senturi runs exactly that on every machine it looks after — daily, verified, offsite — and the verification step is the one we would not skip, because a backup nobody has checked is only a belief.