Nobody reads the backup logs until they need them

I have restored backups that were empty, backups that stopped six months earlier, and backups that contained a perfect copy of an already-compromised site. In every case someone had a dashboard with a green tick on it.

A backup is not a backup until you have restored it somewhere else and looked at the result. Once a quarter is enough. Put it in the calendar and give it to whoever is least confident about it, because they will actually check.

Half of security work is not clever. It is verifying the boring thing everyone assumes is already true.