Why doesn’t backup alone protect against cyberattacks?

Backup only creates copies of data but doesn’t guarantee quick recovery. Attackers often destroy backups before deploying malware, leaving companies unable to resume operations promptly.

What risks does the lack of a recovery plan entail?

Without a recovery plan, companies face prolonged downtime, revenue loss, customer trust erosion, and difficulties obtaining cyber risk insurance. Regulators are also tightening business continuity requirements.

How do hybrid environments impact data security?

Hybrid environments expand the attack surface, as threat actors bypass traditional defenses by exploiting vulnerabilities in cloud services and user accounts. Attacks often begin with credential compromise.

← All news

Security

Why Recovery Readiness Is the New Standard for Cyber Resilience

August 11, 2026

Photo: ZDNet

Quick answer

Data recovery readiness has become a cornerstone of cyber resilience, as modern ransomware attacks target backups in 90% of cases.

Modern cyberattacks rarely stop at data encryption—in 90% of cases, attackers first attempt to destroy backup copies. This makes traditional backup strategies insufficient for business protection. Even if backups exist, their mere presence doesn’t ensure rapid recovery after an incident. Experts warn that companies relying solely on backups risk prolonged downtime and financial losses.

Hybrid IT infrastructures, combining on-premises and cloud solutions, have become the norm for most organizations. However, this has expanded the attack surface: threat actors increasingly exploit account compromises, bypass multi-factor authentication, and hijack active sessions. In 80% of attacks, breaches begin with identity-based attacks, with backup storage being a primary target. While cloud providers like Microsoft and Google ensure service uptime, data protection remains the customer’s responsibility.

To achieve true cyber resilience, businesses must transition from basic backups to comprehensive recovery strategies. This includes creating immutable backups, regularly testing recovery plans, and using specialized tools like Datto Screenshot Verification, which automatically verify backup functionality. Without these measures, even successful backups may prove useless in critical situations.

Regulators and insurers are tightening cyber resilience requirements. Standards such as CMMC, GDPR, NIS2, and DORA mandate business continuity and logical data separation. Without tested recovery plans, companies risk not only financial losses but also legal consequences. Experts recommend starting with an audit of current processes and implementing automated data recovery solutions.

Common questions

Why doesn’t backup alone protect against cyberattacks?: Backup only creates copies of data but doesn’t guarantee quick recovery. Attackers often destroy backups before deploying malware, leaving companies unable to resume operations promptly.
What risks does the lack of a recovery plan entail?: Without a recovery plan, companies face prolonged downtime, revenue loss, customer trust erosion, and difficulties obtaining cyber risk insurance. Regulators are also tightening business continuity requirements.
How do hybrid environments impact data security?: Hybrid environments expand the attack surface, as threat actors bypass traditional defenses by exploiting vulnerabilities in cloud services and user accounts. Attacks often begin with credential compromise.

Dzen feed: /feed/dzen.xml · RSS: /feed.xml