A few years ago, a growing fintech company lost one of its cloud environments. This is an alarming but not unheard-of occurrence, globally. But as the team scrambled to fix the problem, a more insidious issue revealed itself.
The team believed it was prepared because, on paper at least, it was. Backups had been configured and data was being stored. If something went wrong, the assumption was that the environment could be restored within a few hours.
Instead, the recovery took weeks.
“The client had certain backups and protection enabled, but they didn’t have a true recovery process,” says Adam Gallant, project lead at KineticSkunk. “Backups are not the end result. You must prove that they can be restored, and you must prove that what you have backed up is the latest version of your data and application.”
The incident exposed a distinction that is easily overlooked: storing a backup and recovering a working system are two different outcomes.
It is this gap that KineticSkunk’s Store, Protect & Prove service has been designed to address.
A risk that can remain hidden for years
For many small and medium businesses, an untested recovery process behaves like a latent condition. Nothing appears wrong while systems are functioning normally. Applications remain available, and customers can transact while backups continue running in the background.
The weakness only becomes visible when the organisation is placed under pressure.
This may happen when a system fails, or auditor requests validated recovery metrics. At that point, the business must demonstrate more than the existence of backup files. It must show that its systems can be rebuilt within an acceptable timeframe and that the recovered data meets the organisation’s recovery point objectives.
“A lot of people understand that once they have backups enabled on a service, that is the end result and they should be fine from then onwards,” Gallant says. “The missing piece is whether they can recover with the backups they have implemented.”
The problem is particularly relevant to scaling fintech businesses and other engineering-led SMEs operating in regulated or enterprise environments. These organisations are often expected to provide disaster recovery documentation and tested recovery time objectives as evidence that their systems can withstand disruption.
But the same businesses are usually moving quickly. As start-ups, their cultures were built on the thrill of competition and the promise of success. Now, their engineering teams are focused on launching products and acquiring customers.
“When companies start, they focus on building the application, getting into the cloud and getting their first clients,” says Gallant. “They are not always focusing on adding resilience to the application or considering disaster recovery as a process.”
The double edge of cloud technology
Cloud platforms have given smaller businesses access to capabilities that were previously available mainly to large enterprises. AWS provides scalable storage and automation, and a broad ecosystem of services without requiring companies to invest in extensive physical infrastructure.
This has helped level the competitive landscape. A South African fintech can develop and deploy services at a pace that would have required substantially more capital and personnel in an earlier era.
That power has another edge.
Technology is advancing at breakneck speed and competitive pressure rewards businesses that move quickly. Environments therefore evolve incrementally. Different services are added to solve immediate problems and responsibility becomes distributed across teams. This often means that backup can gradually turn into a checkbox rather than an actively tested business capability.
Uptime Institute’s 2025 outage analysis suggests this operational gap remains widespread. Nearly 40% of organisations surveyed had experienced a major outage involving human error during the previous three years. Of those incidents, 85% were linked either to staff failing to follow procedures or to flaws in the procedures themselves. The institute also found that increasingly complex IT and network environments are contributing to problems such as misconfiguration and unclear responsibility.
AWS provides the underlying tools for resilience, but organisations remain responsible for configuring their environments appropriately and validating that recovery works. That responsibility lies with them because nobody knows their business and strategy better than they do. They know best which environments to prioritise and protect. But how often can they prove they really have?
“When you go into the cloud, resilience and reliability are part of the foundation layer,” Gallant says. “We are covering a gap that people may not be focusing on or may not understand in terms of the complete backup and recovery scenario.”
From assumed protection to proven recovery
KineticSkunk’s Store, Protect & Prove service begins by assessing the organisation’s environment and identifying its critical applications and data. It conducts a backup and recovery discovery process to establish what must be protected, how frequently it should be backed up and how quickly it needs to be restored. The team then implements the required controls and validates the recovery process.
According to Gallant, the typical engagement moves from discovery into implementation and testing, followed by the delivery of runbooks, documentation and operational knowledge.
The system can also be configured to test backups and recovery processes automatically at scheduled intervals.
“If you set up validation every month, depending on your schedule, the solution will test your backups and recovery processes,” he says. “It maintains the recovery process to validate that it is working.”
KineticSkunk can continue as a managed partner, monitoring changes to the environment and ensuring that new applications or data sources are included in the recovery model.
This matters because resilience is not static. As a company grows, enters new markets or wins larger customers, the potential impact of failure expands. A recovery approach that was adequate for an early-stage application may no longer meet the commercial or regulatory demands placed on the business.
Helping southern African businesses compete globally
KineticSkunk sees Store, Protect & Prove as part of a broader commitment to helping southern African SMEs build world-class technology organisations.
INTERPOL’s 2025 Africa Cyberthreat Assessment reported that South Africa recorded 17 849 ransomware detections in 2024, the highest number among the African countries cited in the report. This does not mean every detection resulted in a successful attack, but it illustrates the intensity of the threat environment in which local businesses are operating.
KineticSkunk sees its role as comparable to that of a specialist diagnosing a weakness before it develops into a business-threatening event. The objective is to identify gaps while there is still time to address them, rather than during an outage, audit or enterprise onboarding process.
The company is currently introducing the service to existing and prospective clients through reviews and proof-of-concept engagements.
“Even large companies have not always focused on this,” Gallant says. “They understand that backup is critical, but they may not have considered what happens to the environment or the virtual machines if they fail.”
In a market defined by rapid innovation and rising scrutiny, confidence cannot rest on the assumption that backups are running.
It must rest on evidence that the business can recover.
Share
Editorial contacts