It’s no stretch to say that most businesses likely feel confident about their cloud strategy today. They have invested heavily in modern platforms, deployed advanced security tools and strengthened identity control.

The environment should look secure, scalable and resilient.

I have seen firsthand where cloud adoption is treated as a modernization milestone and risk reduction strategy. Dashboards turn green, compliance boxes are checked and leadership gets an assurance that the organization is secured since moving to the cloud.

As we move to newer and more modern platforms, the question remains, “How quickly and confidently can your business recover from a cyberattack?”

Cyber recovery in today’s threat landscape determines survival.  The stakes are no longer theoretical. According to IBM’s Cost of Data Breach Report, the global average cost of a data breach is $4.4M globally, and over $10M in the US.

Ransomware has evolved from an IT disruption to a business shutdown event. Industry reports indicate that ransomware is involved in nearly half of the major breaches. According to Sophos’ State of Ransomware report, the average recovery cost now exceeds $2.7 million per incident, excluding reputational damage and lost revenue.

The illusion of a “secure cloud”

Cloud transformation has become synonymous with modernization. Organizations move to the cloud to gain scalability, agility and perceived improvement in security.

Cloud providers invest billions into securing their data infrastructure with capabilities that far exceed what most organizations could build on premises. But here’s where the illusion begins.

Many organizations equate cloud adoption with risk reduction, if migrating workloads inherently makes them more secure. Cloud does not eliminate the cyber risk. It changes its shape and shifts its ownership.

In a cloud environment, many of the risks move up the stack:

• From infrastructure to identity
• From perimeter defense to identity access
• From static system to dynamic API driven architecture

One of the leading causes of cloud breaches is simple misconfiguration. Publicly exposed storage and overly permissive roles continue to create entry points for attackers. These are the failures of implementation and governance.

In a traditional environment, attackers target networks. In the cloud, they target identities. Compromised credentials, privilege escalations and weak access control allow attackers to move laterally across systems.

Once inside, they strategically target backups and recovery systems, ensuring that restorations become difficult or impossible.

The most dangerous aspect of this illusion is the belief that resilience is built in. Cloud platform provides high availability. A system can be highly available but still can have corrupted restore, fail to meet business recovery timelines and reintroduce vulnerabilities during recovery.

Recovery as the KPI

For years, cybersecurity has been built around a single objective, which is prevention. Organizations have invested heavily in firewalls, endpoint protection, identity controls and zero-trust architecture. While these investments remain essential, they are no longer sufficient. The reality is that no organization can prevent every attack.

It’s a fundamental change in thinking:

• From: Can we stop every attack?
• To: How quickly and safely can we recover when an attack succeeds?

When the cyberattack occurs, the initial breach is only the beginning. The real impact unfolds in the hours and days that follow. The system goes offline, operations stall, customers are affected and revenue streams are disrupted. The question is how well the organization is prepared and how quickly they respond when such a scenario occurs.

Speed of recovery is the new competitive advantage. An organization that recovers faster can restore operations with minimal downtime, maintain customer trust and limit financial and reputational damage. Those that don’t face prolonged outages, risk regulator exposures and experience long-term brand erosion. Recovery should be the board-level priority. Traditional technical metrics must be reframed in business terms.

RTO and RPO

Metrics like recovery time objective (RTO) and recovery point objective (RPO) have existed for decades, but at times have been buried in infrastructure discussions. This needs to be changed.

RTO defines how quickly the systems must be restored.

RPO defines how much data loss is acceptable.

Recovery must also be trusted, not just fast

Speed alone is not enough. One of the most overlooked challenges is data integrity. After an attack, organizations must ensure that restored systems are not only operational but clean and uncompromised.

This leads to the question. Can it be restored quickly and safely?

In many incidents, organizations discover that the backups are infected, data was silently corrupted and the recovery process reintroduces vulnerabilities. Data from Veeam shows that when backups were compromised, recovery time increases substantially, often accompanied by higher data loss and extended business outage.

Here is a key insight on attackers increasingly dwelling in the system for weeks and compromising the backup process before triggering ransomware. This leads to backups already containing malicious artifacts and delayed detection and unsafe recovery attempts.

What a modern cyber recovery strategy must include

Building a cyber recovery capability establishes a resilience layer across the organization. At a minimum, this includes:

• Isolated recovery environment: This must be protected from the primary network to prevent lateral movement during an attack. Logical or physical isolation ensures that recovery assets remain intact even when the production system is compromised
• Immutable backups: Data must be protected against deletion or encryption. This ensures that backups cannot be altered, even by privileged users or attackers.
• Clean data validation: Not all backups are safe to restore. Organizations need the ability to scan and validate data before recovery to ensure it is free from malware or corruption
• Orchestrated recovery workflow: The manual recovery process is too slow and error-prone during a crisis. Automated workflow enables faster and more reliable restoration.
• Regular testing and simulation: A recovery plan that hasn’t been tested is a risk. Simulating a cyberattack scenario helps an organization measure readiness, identify gaps and improve response time.

Five questions the business should ask

As cyber threats continue to evolve, businesses should challenge themselves with a new set of questions:

1. Can we recover our most critical systems within a business-defined timeframe after a cyberattack?
2. Do we have an isolated environment to ensure a clean recovery?
3. How do we validate that recovered data is not compromised?
4. When was the last time we tested a full cyber recovery scenario?
5. Who owns cyber recovery as a capability across the organization?

Resilience defines leadership in the cloud era

Cloud has transformed how organizations build, scale and operate technology. It has delivered agility, speed and a new level of architectural resilience. But it has also introduced a more complex and unforgiving risk landscape, where cyber threats are not only inevitable, but increasingly designed to disrupt recovery itself.

Cyber recovery must be treated as a strategic capability, not an operational afterthought.  An organization should not only have a cloud strategy but also a cyber recovery plan.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?