Maintenance
Part of Backup and recovery: a grounded overview
Best backup and recovery software 2027: facts and context, in plain terms
The best backup and recovery software for 2027, ranked by what each product restores and what it cannot, with the trial checks that separate them.
Every product in this category copies your files. That is not the hard part, and it does not separate them.
The hard part is producing a readable copy, at a moment you choose, of the right data, from a place the failure did not reach, fast enough that the business is still trading when it arrives. Judge every candidate on that sentence.
What to take away
- Veeam, Acronis, N-able Cove, Datto, Druva and MSP360 all copy files; they differ on immutability, local speed and who holds the encryption key.
- A copy your own administrator account can delete is a copy the person holding that account can delete.
- Buy against a per-system answer to how much data you can lose and how long you can be down.
- The trial that matters is a timed restore of a whole machine into an isolated network, not a green tick on a dashboard.
The products worth shortlisting
Veeam Backup and Replication. Image-level backup for VMware, Hyper-V and physical agents, with a hardened Linux repository that can hold a copy your Windows administrator cannot delete. Suits a business with at least one server and someone who can read a job log. Licensed per workload, perpetual or subscription, sold through resellers.
Acronis Cyber Protect. Image backup, file backup and endpoint protection in one agent, which is convenient for a business with no server room and awkward if you want to change antivirus without changing backup. Per-device subscription. It suits a five-to-fifty seat office.
N-able Cove Data Protection. Cloud-first backup for servers, workstations and Microsoft 365, sold only through managed service providers. TrueDelta charges on changed blocks, so a slow northern link is less of a problem. Monthly per-device pricing set by your provider, not published.
Datto SIRIS and Alto. A local appliance holds recent recovery points and syncs an encrypted copy to Datto's cloud, so a whole machine restore happens at local disk speed. The appliance is the point and also the cost. Sold through partners on a monthly per-device plan.
Druva. Cloud-native backup for endpoints, servers and Microsoft 365, with no appliance to buy or patch. It suits a distributed workforce on decent connections and a business that would rather not own hardware. Per-user and per-workload subscription.
MSP360 Backup. Budget option that writes to storage you already pay for, including Backblaze B2, Wasabi and Amazon S3. Cheap on licence, but you own the bucket, the keys and the restore test. Per-machine licence plus your storage bill.
The cost bands below are indicative and typical for a small business in the United States, quoted per device before reseller discount. The licence is only part of the bill, and availability and data residency differ between the United States and Canada.
| Product | Indicative cost, US | Typical RPO | Typical restore |
|---|---|---|---|
| Veeam | Per workload; low hundreds of dollars a year on subscription, or perpetual plus maintenance | Set by the job schedule, typically 15 minutes to 24 hours | Instant Recovery boots a virtual machine in minutes; a full restore over the network runs to hours |
| Acronis | A few dollars per device per month for the base plan, more with cloud storage | 15 minutes or longer | Bound by network speed |
| N-able Cove | Provider set, not published by the vendor | Minutes, measured on changed blocks | Bound by download speed unless the provider stages a local copy |
| Datto SIRIS and Alto | Appliance cost plus a per device monthly plan | Around five minutes on the appliance | A failed machine boots on the appliance in minutes, at local disk speed |
| Druva | A few dollars per user and low tens of dollars per server per month | Minutes to hours, set by policy | Bound by network speed |
| MSP360 | A few dollars per machine per month, plus your own storage bill | Whatever you schedule | Set by your link and your bucket |
The order for a small business: Veeam first, Datto second, Druva third, then Acronis and N-able Cove where a provider runs the stack. Pick MSP360 only if the budget decides and you accept owning the bucket, the keys and the restore test.
Two costs sit outside the licence. The hours somebody spends checking and testing are one. The second is the egress charge when you pull a whole machine back out of cloud storage, which on a large restore can exceed a year of the subscription.
Ask for that number before you sign.
The purchasing argument in security foundations treats both as the first line of any security spend.
Answer two questions before you shop
Both are per system, not per business, and both are business questions rather than technical ones.
How much data can this system afford to lose? That sets how often it is copied.
How long can the business run without this system? That sets how the copy is stored and how it is brought back, because restoring across a broadband connection and restoring from something in the building are different orders of duration.
Write the two answers beside each system on your inventory. The United States National Institute of Standards and Technology's contingency planning guide gives these the names recovery point and recovery time, and having the names makes the sales conversation shorter. The per-system reasoning behind the numbers is in backup and recovery.
The drill that decides it
Trial the candidate on real data for two weeks, then spend one morning doing this. Do it on a scratch machine or a spare location first, never over the live copy.
The Restore Drill
- Restore one file from a week ago, open it
- Restore a whole folder, compare file count
- Restore a whole machine, time it, write number
- Delete something from backup as admin
- Change retention, see if anyone is told
- Disconnect source, restore from elsewhere
- Find encryption key, prove reach from outside
- Note the clock time you start, and the recovery point you are restoring to.
- Restore one whole machine, not a folder, into a network with no route to production.
- Boot the machine and log in with an ordinary user account.
- Open the three applications the business depends on and check the data reaches your chosen point.
- Stop the clock when the machine is usable, and write the minutes down.
- Repeat the restore from the oldest recovery point you say you keep.
- Do it with only the credentials and keys a new administrator would hold on day one.
Step seven ends more evaluations than any other. An encrypted archive whose key existed only on the lost server is an unreadable file with good intentions.
The United States Cybersecurity and Infrastructure Security Agency's plain note on data backup options is a fair one-page statement of the same ground, and it is short enough to hand to whoever signs the invoice.
What the sales material relies on
| The claim | What it usually means | Ask instead |
|---|---|---|
| Unlimited storage | Unlimited within a fair use clause you have not read | What happens, specifically, when we exceed what you consider normal? |
| Immutable | Cannot be changed, by most people, in most tiers | Can an administrator of our own account shorten the retention window? |
| Air gapped | Held on separate infrastructure, reached over a network | Is there a credential in our environment that can reach it? |
| Instant recovery | A machine boots quickly from the backup and runs slowly | What is the performance while running from backup, and how long is the full move back? |
| Verified backups | A checksum matched after writing | Does verification ever open the archive and read content? |
| Deduplication ratio | Measured against a sample that compresses well | What ratio have customers with data like ours actually seen? |
| Set and forget | Nobody will look at it | Who receives a failure notice, by what route, and how do we test that route? |
The login that administers the backup console becomes one of the most powerful credentials in the business. It belongs under the strongest protection you use, as identity and access sets out.
Where the tool stops
A backup product does not decide the order things come back in, does not know which system the business cannot trade without, and cannot tell you whether the environment you are restoring into is still compromised. Those are the decisions in incident response, and buying a good product without settling them produces a fast restore of a problem.
It also does not cover what your online services hold unless you point it at them. What the platform keeps for you, and for how long, is a separate question answered in cloud security.
Common questions
Is the backup built into our operating system or platform enough?
It usually covers everyday mistakes well and the immutability job badly. Check specifically whether a copy exists that your own administrator account cannot delete, and whether anything reaches back further than a few weeks. Where both answers are no, that gap is the reason to buy something, and it is a much narrower reason than the brochure suggests.
How long should the trial be?
Long enough for a full copy to complete, a change to be captured, and a failure to happen naturally. Two weeks is the usual minimum, and the morning of drills matters more than the fortnight.
What if we cannot restore a whole machine during a trial?
Then restore a whole share, and ask the vendor to demonstrate a full machine restore on their own equipment while you hold the stopwatch. A number you have not seen produced is a number you do not have.
Can a managed provider do this for us?
They can run it. They cannot hold your only key, and they should not be the only party who can prove a restore works. Ask for the restore test report, with dates, and read it once a year.
