Recovery fails at the layers most backup programs never cover

Backup programs are often measured by whether they can restore data and virtual machines. Business recovery depends on a broader chain of trust that includes identities, policies, secrets, network settings, application bindings, and evidence that the chosen recovery point is safe.

When those dependencies are missing or compromised, a fast restore can leave teams locked out, production misconfigured, or attackers quietly reintroduced.

Recovery capability means re-establishing a trusted operating state, not simply retrieving stored artifacts.

Identity Is the Recovery Dependency Nobody Backs Up

A restored workload cannot serve the business until authentication and authorization return under controlled conditions.

Cyber recovery is an identity governance problem as well as a storage exercise. A backup can return application data and virtual machines while operations remain stalled because the directory, identity provider, permissions, service credentials, or cloud policy configuration has not returned in a trustworthy state. Restored capacity has limited value when the environment cannot establish who or what may access it.

Identity is a control plane, meaning the services and policies that govern authentication, authorization, and administrative authority across the environment. Its recovery differs from data recovery in kind. Zachary Symm, a product manager at Rackspace Technology, notes that Microsoft’s own Active Directory forest recovery guide runs from 40 to more than 100 discrete manual steps, with domain controller sequencing, role seizure, replication validation, and trust rebuilds that have no equivalent in restoring a file share.

Trust determines the recovery approach. Rubrik, which sells identity recovery tooling, separates availability, whether a user can sign in, from integrity, whether the directory can be believed. Its December 2025 analysis cited CrowdStrike’s previous finding that 75 percent of intrusions were identity-driven and malware-free. It also noted three limits in Entra ID. Many objects hard-delete immediately. Soft delete covers a limited set. There is no native tenant-wide point-in-time restore. Restore users before the control plane and you onboard them straight back into an attacker-owned directory. When the compromise window is uncertain, a clean rebuild can be safer than a rapid rollback.

Credentials are where most incidents begin. Verizon’s 2025 Data Breach Investigations Report found that 88 percent of breaches involved compromised credentials. Non-human identities, or NHIs, widen the gap conventional backup plans miss. The NHI Mgmt Group’s 2025 State of Non-Human Identities and Secrets in Cybersecurity reports that 91% of former-employee tokens remained active after offboarding and 62% of secrets were duplicated across multiple locations. A restored identity estate may therefore contain stale credentials while a required machine credential is unknown, expired, or dependent on an unavailable secrets platform. Veeam Software’s 2026 Data Trust and Resilience Report reports that 28% of surveyed organizations fully restored data after ransomware and that average recovery reached 72% of affected data. Those figures do not isolate identity failure, but recoverable data alone does not prove usable recovery.

Identity continuity needs the same treatment normally reserved for tier-one applications. Darren Mar-Elia, principal security strategist at Semperis, an Active Directory security vendor, argues that buyers should demand a demonstrated recovery inside their own recovery time objective on a realistic environment, and that any solution must handle persistence and backdoors planted inside the directory database itself, not only a compromised operating system. Recovery evidence should demonstrate that the restored layer can authenticate, authorize, revoke access, and support privileged administration without reconnecting the compromise the organization is trying to escape.

The Operator’s Lens

• Fund identity recovery as a tier-one service, including an isolated validation environment and tested emergency administration path.
• Inventory service accounts, application registrations, signing keys, and secrets with owners before a recovery event exposes undocumented dependencies.
• Require recovery exercises to prove both human and machine access under intended policy before application teams declare a service available.

Trusted access is useful only when the policies and technical settings governing the service return with it. Recoverable state must include the configuration that turns restored components into a working system.

Configuration Is Recoverable State Too

Infrastructure becomes usable again only when its approved settings and dependencies return in a consistent state.

ControlMonkey announced expanded configuration backup and recovery for CrowdStrike, Zscaler, Fortinet, and Palo Alto Networks on September 9, 2026. The announcement does not establish broad deployment success, but it highlights a material blind spot. Restoring virtual machines and data stores does not automatically restore the control plane that decides connectivity, permitted traffic, and active monitoring.

Commvault makes the same case at the cloud layer. In a January 2025 analysis the company argued that application data is only 20 to 30 percent of a typical cloud environment, while 50 to 70 percent is configuration, including load balancers, security groups, network policies, identity and access settings, and container orchestration, none of which a data-only restore brings back. On August 18, 2026, it expanded its Cloud Rewind product, which maps application dependencies and rebuilds infrastructure and configuration together, to cover what it says is 62 percent of enterprise-relevant Microsoft Azure resource types. Pranay Ahlawat, Commvault’s chief technology and AI officer, said modern applications depend on interconnected services, infrastructure, and configurations that have to come back together.

The distinction is sharper in OT environments. Bostjan Kirm, chief executive of Hyperbunker, a vendor of offline recovery storage, said in September that the materials needed to restart production are often under one terabyte. That compact set spans several layers of the plant.

• Supervisory control and data acquisition project files
• Programmable logic controller programs and human-machine interface backups
• Network configurations and historian data

Those assets can determine whether a line resumes or engineers have to reconstruct its operating state from memory.

The cost of getting this wrong is on the manufacturing record. When JLR’s (Jaguar Land Rover) plants stopped after its September 2025 cyberattack, they stayed idle for roughly five weeks. U.K. car production fell 27 percent for the month and the Cyber Monitoring Centre estimated the incident cost the U.K. economy about £1.9 billion across more than 5,000 supply chain organizations. The Clorox Company lived the same pattern in August 2023, when its systems were restored but production stayed offline for a month, and the company put its losses at $356 million.

Configuration drift complicates point-in-time recovery. Peter Lukesch, chief executive of ondeso, an industrial PC management vendor, said in September that workstation and controller layers evolve independently, and that controller and field-layer settings can change daily. A recovery point that restores an operating system but predates a production adjustment can be technically functional and operationally wrong.

Identity and cryptographic dependencies show why configuration recovery cannot be deferred. Microsoft’s 2026 Azure Key Vault documentation states that deleted keys, secrets, certificates, and vaults can remain recoverable for a configured period of 7 to 90 calendar days, with 90 days as the default. Recovering a deleted vault does not restore connected role assignments or event subscriptions. Object recovery can leave a service unusable when its permissions, bindings, policies, or integrations were not captured with it.

Time to restore a safe, usable service is a more credible measure than time to report a server online.

The Operator’s Lens

• Place security policies, cloud settings, network rules, and OT project files under versioned protection with the same retention discipline as production data.
• Link each recoverable configuration baseline to an approved change record so teams can select a defensible state under pressure.
• Budget recovery testing around business transactions and production safety checks rather than infrastructure boot tests alone.

Version-consistent configuration narrows the path to restoration, but it cannot establish whether the selected state predates an intrusion. Security evidence must determine whether a complete recovery is safe to reconnect.

A Complete Restore Is Not the Same as a Clean One

Intact backup artifacts are only the starting point. Recovery decisions also need forensic confidence and application validation.

Microsoft’s own support guidance shows how routine the gap is. A virtual machine recovery point recreates the operating system, installed software, and attached disks. Databases may need separate point-in-time restoration, while network addresses, DNS records, permissions, and application bindings may need rebuilding or reassignment. A restored server can look complete before its business service is coherent and usable.

Ransomware recovery sets a higher bar. An attacker may alter identity infrastructure, privileged accounts, scheduled tasks, startup mechanisms, remote management settings, or application configuration long before encryption reveals the intrusion. Restoring the final backup before encryption can reinstall the same foothold. Storage immutability, where backups cannot be changed or deleted during a defined retention period, protects the backup artifact from tampering. It does not certify that the artifact predates compromise.

The defensible recovery point comes from joining backup timestamps to endpoint alerts, authentication events, administrative changes, and evidence of lateral movement. This establishes a last known-good point from the observed attack timeline, which is especially important when identity systems and affected applications follow different backup schedules.

Commvault’s answer to that question is what it calls a Cleanpoint, a backup that has been scanned for threats with none found. The company describes its Threat Scan as combining signature matching, YARA rules and file hashes, encryption detection, and behavioral analytics across backups, with suspicious files quarantined so they cannot be restored. In November 2025 it added Synthetic Recovery, which assembles the most recent clean version of each file from across the backup estate into a single recovery point rather than restoring one intact but possibly compromised snapshot. That is a vendor-described capability, but it makes the article’s point concrete. The clean recovery point may not exist as any single backup, and it has to be built from evidence.

Cleanliness is tested outside production. An isolated recovery environment needs separate identity services, no trust path to production, and tightly limited outbound connectivity. Three checks belong there.

• Restore the application stack and inspect privileged identities and persistence locations
• Compare configurations with approved baselines
• Exercise representative business transactions before reconnection

A successful boot, accessible file share, or mounted database is evidence of restoration rather than proof that the environment is safe to reconnect.

Recovery time and recovery point targets are meaningful only when measured through this clean-room sequence. A fast restoration that returns adversary persistence creates a delayed reinfection event.

The economics reward the discipline. Bostjan Kirm cites Sophos research putting median recovery cost near $3 million when backups are compromised against $375,000 when they survive, and says attackers hit backups in 94 percent of ransomware cases. His standard, which he ties to NIS2, IEC 62443, and ISO 27001, is that every sector now demands a recovery that is proven rather than merely performed.

The Operator’s Lens

• Set recovery-point selection with security telemetry and business owners, not by backup recency alone.
• Maintain an isolated clean-room environment that can restore priority services without trust connectivity to production.
• Make security attestation and business transaction reconciliation exit criteria for every ransomware recovery drill.

Identity restores access, configuration restores intended behavior, and clean-room validation establishes whether the recovered environment deserves trust. Treating any one of these as outside backup scope creates a recovery plan that can return assets without returning operations. The durable standard is evidence that a service is usable, correctly configured, and safe before it reconnects to the enterprise.