Most organisations have a disaster recovery (DR) plan, and many assume it covers them for a cyber attack. Often it does not, and the gap tends to become visible only during an incident.
What is the difference between cyber recovery and disaster recovery?
Traditional disaster recovery was designed around infrastructure failure: a data centre loses power, a flood takes out a comms room, hardware fails, or a migration goes wrong.
In each of those scenarios one assumption holds. The data is fine. The most recent backup can be trusted, the directory is intact and the recovery runbook is accurate. The infrastructure holding the data has stopped working, so you fail over, restore and resume.
A cyber attack can break that assumption at every point. Data may be encrypted, deleted or quietly altered. Backups may be encrypted or deleted too, because attackers increasingly look for them first. Mandiant’s M-Trends 2026 report describes ransomware groups in 2025 actively targeting backup infrastructure, identity services and virtualisation management, and deleting backup objects from cloud storage. The directory everything authenticates against may be under the attacker’s control, and the runbook may sit on a file share that is no longer accessible.
Cyber recovery is the discipline of restoring operations when you cannot trust your own environment.
Four differences that change the plan
After a flood, the last backup is the right backup. After a ransomware attack, the last backup may contain the attacker’s tooling. Mandiant put the global median dwell time, the period between compromise and detection, at 14 days in 2025, and at 122 days for espionage-related intrusions. Recovery therefore begins with an investigation: when did the compromise start, and which recovery point predates it? Restoring the most recent backup without answering that question can reintroduce the attacker.
Restoring into the same network, with the same credentials, risks reproducing the compromise. Cyber recovery usually needs an isolated environment, often called a clean room, where systems can be restored, examined and validated before they are reconnected.
A backup that an attacker with administrative credentials can encrypt or delete is not a reliable recovery capability. The National Cyber Security Centre’s (NCSC) principles for ransomware-resistant backups set out what that means in practice: isolating the backup system, using credentials separate from the rest of the network, blocking deletion or alteration of backups for a defined retention period, and alerting on attempted privileged changes.
A hardware failure produces a technical problem. A cyber attack can produce a technical problem alongside several other obligations at once. Under Article 33 of the UK GDPR, a personal data breach that is likely to result in a risk to individuals must be reported to the regulator without undue delay and, where feasible, within 72 hours of becoming aware of it. There may also be law enforcement contact, cyber insurer conditions, forensic work that requires systems to be preserved rather than rebuilt, and communications with customers and staff.
“The question I ask is simple,” says AJ Thompson, Chief Commercial Officer at Northdoor. “Your DR plan says you can be back up in four hours. Does that four hours include working out which backup is clean? Because if the answer is no, and it usually is, then that number describes a completely different event from the one you’re worried about.”
How long does recovery from a cyber attack take?
IBM’s Cost of a Data Breach Report 2026 is useful here because it measures outcomes. Of the breached organisations in the study, 42 per cent said they had fully recovered, up from 35 per cent the year before.
On speed, 4 per cent recovered fully within 50 days, 29 per cent took between 101 and 125 days, and 19 per cent took more than 150 days, down from 26 per cent the previous year. Those timelines bear little resemblance to the recovery time objectives in many DR plans. We covered the wider findings in our summary of the 2026 Cost of a Data Breach report.
What does a cyber recovery capability include?
- Isolated copies of critical data that cannot be altered or deleted for a defined retention period, set long enough to reach back before a plausible dwell time. The NCSC suggests setting retention by time period rather than number of copies, so an attacker cannot overwrite every good copy by forcing repeated backups.
- Backup infrastructure on separate credentials, not joined to the production directory. Mandiant’s 2026 recommendations make the same point: decouple backup environments from the corporate Active Directory domain.
- A clean-room recovery environment, or at minimum a documented plan for creating one under pressure.
- The ability to scan a backup before restoring it, so malware and known indicators of compromise are found at the recovery point rather than after reconnection.
- A recovery order agreed with the business in advance, usually starting with identity, because little else can be validated until authentication can be trusted.
- Offline copies of the plan itself, including contact details, licence keys and vendor support numbers.
- Restores tested end to end on a schedule, with the elapsed time recorded.
How to find your own gap
Take your existing DR plan and read it against one scenario. An attacker has held domain administrator rights for three weeks, has encrypted the production file estate and the primary backup repository, and Active Directory can no longer be trusted.
Then work through it. Which backup do you restore, and how do you know it is clean? Where do you restore it to? How do you authenticate to the backup system if the directory is compromised? Who has the vendor support numbers if email is down? How long does the resulting timeline look?
Most plans contain at least one assumption that does not survive that reading, and it is far cheaper to find it in a workshop than during an incident.
What this means for your organisation
Cyber recovery does not replace disaster recovery. Infrastructure still fails, and a good DR plan handles that. What cyber recovery adds is the ability to recover when the data and the environment around it cannot be trusted. If your DR plan has only been tested against an outage, it is worth testing it against an attack. Our cyber recovery and cyber resilience team runs that exercise with clients, alongside ransomware protection, data storage and managed security services. Ask us about it.