Operating picture · measured 2026-09-11
12,422 US IT providers name backup or disaster recovery — 31.3% of the market.
Nearly a third of US providers sell backup. 3,680 of them sell it without naming a single security service — backup bought as an alternative to security rather than a companion to it.
of 39,722 US providers name backup, disaster recovery or business continuity
n = 39,722 published US providers, of which 12,422 name backup, disaster recovery, business continuity, data recovery or ransomware recovery among the services they offer. Asset-recovery and project-recovery tags are excluded by name. Services are on file for 35,759 of the 39,722, so an unknown counts against the share and 31.3% is a floor. Shares labeled "of the backup group" are against those 12,422. Measured 2026-09-11 in one repeatable-read snapshot.
- Shows a certification
- 23.9%
- Shows a Google rating
- 59.6%
- Median reviews, rated firms
- 10
- Median headcount
- 7
- Shows a certification
- 15.6%
- Shows a Google rating
- 43.8%
- Median reviews, rated firms
- 7
- Median headcount
- 9
Backup is named more often than it is specified
12,422 of 39,722 published US providers name backup or disaster recovery — 31.3%. It is the second most-claimed service on this site after cybersecurity, which 20,254 firms, or 51.0%, name.
Almost all of that volume sits in one undifferentiated tag. 11,130 of the 12,422 carry a combined backup-and-DR tag, against 752 carrying a standalone disaster-recovery tag and 342 a business-continuity tag. Those tags are not exclusive and a firm may carry several. Backup and recovery are sold as one word, which is convenient for a provider and unhelpful for a buyer, because they are different obligations with different costs.
The group is smaller than the directory by headcount, not larger: a median of 7 staff over the 10,395 that publish one, against a directory median of 9 over 31,249. Backup is a line small providers can carry, because the platform does most of the work.
3,680 providers sell backup with no security service at all
8,742 of the 12,422, or 70.4%, also name a security service. The remaining 3,680 — 29.6% of the backup group — name backup or disaster recovery and name nothing security-related at all.
That matters because modern ransomware targets the backup first. A recovery plan that assumes clean restore points, held by a provider who names no detection, monitoring or incident response, is a plan with an untested assumption at the center of it.
The gap runs the other way too, and wider: 11,512 providers name a security service and name no backup or continuity service. Across the directory, security and recovery are sold by largely different firms rather than as one practice.
Credentials, visibility and price
2,969 of the 12,422 show a certification of any kind — 23.9%, against 15.6% directory-wide. 9,453 providers selling backup and disaster recovery show a buyer no third-party credential at all.
The group is easier to find than the typical provider: 7,409, or 59.6%, show a Google rating against 43.8% directory-wide, at a median of 10 reviews among rated firms against 7. California 1,320, Texas 1,065, Florida 991, New York 737, Pennsylvania 474 and Illinois 429 lead by headquarters, which tracks provider density rather than anything about recovery.
220 of the 12,422 publish a per-user, per-month rate — 1.8% of the group. Among those 220, the median of each firm's lowest published per-user monthly rate is $89. That describes those 220 firms; at 1.8% coverage it is not a backup pricing benchmark, and backup is frequently billed per device or per terabyte rather than per user in any case.
What this number can't tell you
- ·This measures what providers publish about themselves, not what they operate. A provider running backup for every client who never names it is counted in the 68.7%.
- ·Services are on file for 35,759 of the 39,722 published firms, so 31.3% is a floor and an unknown counts against it.
- ·Service tags are matched as stored tokens. The group is every firm carrying a tag containing backup, disaster_recovery, business_continuity, bcdr, data_recovery or ransomware_recovery. Asset-recovery and project-recovery tags are excluded by name because they are unrelated work that a plain match on "recovery" would pull in.
- ·The 11,130 combined backup-and-DR tag cannot be split. A firm carrying it may offer full disaster recovery, nightly file backup, or anything between; this data cannot tell those apart, and the split between the 752 DR-only and 342 continuity tags should not be read as the shape of the market.
- ·"Names no security service" means no tag containing cybersecurity, security, SOC, SIEM, EDR, MDR, penetration testing or incident response. A provider doing security work under a different label is counted in the 3,680.
- ·Median headcount is over the 10,395 firms in the group that publish one, and self-published headcounts are not audited.
- ·Review medians are over rated firms only. Rating values themselves are not plotted: google_rating bunches at the top of its range and a percentile of it would mislead.
- ·State counts are provider headquarters, not service areas.
- ·The pricing figure is the median of each firm's lowest published per-user, per-month rate, over the 220 firms in this group that publish one, filtered to rates between $10 and $500. Backup is commonly priced per device or per terabyte, so a per-user figure is a poor proxy for what this service actually costs.
What to do about it
- ▸Buying: 31.3% of the market names backup, so the claim narrows nothing. Ask for the recovery time objective in hours, the last date a restore was tested, and whether backups are immutable. If the provider names no security service at all — which is true of 3,680 of them — ask who detects the ransomware before the restore is needed.
- ▸Selling: the combined backup-and-DR tag is carried by 11,130 firms and says nothing. Publishing a tested RTO, an immutability statement and a restore-test cadence separates a provider from eleven thousand others using the same two words.
Where does your firm sit on this?
Claim your MSP with a magic link from your company email to see your own certifications, reviews, web footprint and local rank measured against every provider we track.
Claim your MSP ▸More findings
- 76%76% of MSPs that sell cybersecurity hold no security certification at all.
- 77%77% of MSPs marketing to healthcare don't list HIPAA.
- 15,35615,356 US places have no MSP within 25 miles — 24% of the country's populated places.
- 0.01★It makes no measurable difference. Isolated MSPs average 4.67★ across 20 reviews; MSPs in dense markets average 4.69★ across 21.