Prevention attracts budget and attention. Recovery is usually delegated to infrastructure, measured by job success, and rehearsed rarely. This pillar studies whether recovery capability is systematically underinvested relative to its effect on total loss.
The core distinction
A successful backup job is not evidence of recoverability. A successful restore is. The two are frequently conflated in reporting, and the difference only becomes visible during the worst week the organisation will have.
Restores fail for ordinary reasons: the backup captured the data but not the configuration, the recovery environment depends on the systems that are down, the credentials needed to restore were stored in the system being restored, or the restore works but takes four days when the business assumed four hours.
Take an isolated copy, restore it into a clean environment, ask the business to validate it, and record the elapsed time and data loss.
Capabilities under study
Recovery has several parts. Each fails in its own way and needs its own test.
- Immutable and isolated copies
-
Copies an attacker with administrative credentials cannot alter or delete, held where the production identity system has no authority.
- Clean-room rebuild
-
The ability to construct a trusted environment when the existing one must be assumed compromised, including the identity layer.
- Credential reset at scale
-
Rotating every credential, key, token, and service account quickly, which is rehearsed almost nowhere and required in most serious intrusions.
- Degraded-mode operation
-
Running the essential part of the business without the systems that are down, specified in advance rather than improvised.
- Dependency recovery
-
Knowing which third parties must recover before you can, and whether their timelines are compatible with yours.
- Recovery communications
-
What is said to customers, regulators, staff, and partners, with the decision owners named before the event.
The hypothesis about underinvestment
The claim is that recovery testing predicts readiness for destructive attacks better than backup configuration does, and that budget allocation does not reflect this. Both halves need evidence: the predictive claim from incident outcome data, the allocation claim from spending patterns.
What would prove us wrong?
The pillar assumes recovery capability is underweighted relative to prevention.
-
Outcome data showing that organisations with strong prevention rarely reach the point where recovery capability determines the loss.
-
Evidence that recovery drills at meaningful scale cost more in disruption than the expected loss they mitigate.
-
Cases where backup configuration quality alone predicted successful recovery as well as rehearsed restores did.