The backup completed. The restore worked. The servers are back online. And yet the bank cannot process a payment, the factory cannot ship an order and the help desk cannot log a single employee in. That gap between a technical recovery and a working business is where many organisations will discover, at the worst possible moment, that being backed up and being resilient are two different things. It is also the central finding of Cohesity’s 2026 Global Cyber Resilience Report, which surveyed 3,200 IT and security decision-makers across 12 countries and found a striking mismatch between how organisations plan to recover and what recovery actually requires.
Recovering technology is not the same as recovering the business
The report’s headline number is an uncomfortable one. Some 78% of organisations focus their cyber recovery efforts on restoring systems rather than maintaining business operations. Only 22% have tested how critical operations would continue during recovery.
Karam says that imbalance reflects a framing problem at the top of the organisation. “The conversation needs to move from recovering technology to recovering the business,” he says. “Restoring systems is important, but it does not necessarily mean the organisation can serve customers, process transactions or keep critical operations running.”
His prescription is to stop discussing cyber recovery as a backup topic and start discussing it alongside business continuity and operational risk. Boards and C-suites, he says, should understand what Cohesity calls the Minimum Viable Company: “the people, applications, data, identity systems and dependencies that must be restored, and in what order, to keep the business functioning.”
The test he proposes is deliberately practical. “The real test is not whether IT can recover a server. It is whether the organisation can demonstrate that critical business services can continue during a cyber event. That requires cross-functional ownership, regular testing and clear accountability from the top.”
The trust problem: is the data you restored actually clean?
If the first gap is about priorities, the second is about confidence. The report found that 60% of organisations that suffered a material cyberattack experienced moderate or significant recovery delays because they lacked confidence that restored data and systems were clean and safe to use. A further 70% said the scope of affected systems grew beyond their initial assessment after the attack.
Taken together, those figures describe a recovery that stalls not because the backups are missing, but because nobody can be sure what is in them. Karam says that is what separates a cyberattack from a conventional outage. “The question is not simply whether data can be restored, but whether the organisation can establish that the recovery point is safe to use.”
The difficulty lies in what attackers do before they are discovered. “Attackers can remain in an environment for extended periods, compromise credentials or potentially affect recovery infrastructure, so the latest available copy is not necessarily the right one to restore.”
That is why he argues for a defined validation process before any workload returns to production. It begins with “identifying a known-good recovery point, isolating the recovery environment, investigating the attack, scanning and validating the data, addressing vulnerabilities and then restoring workloads.” A clean room, he explains, can provide the controlled environment for that investigation and remediation. “The objective is to make recovery a measured process based on evidence, rather than a decision made under pressure during an incident.”
Resilience has become an architectural question
Modern enterprises rarely fail in one place. Applications depend on cloud infrastructure, SaaS platforms, identity services, APIs and third-party providers, and a recovery plan that treats any one of them in isolation can leave the business stranded.
The report found that 61% of organisations identified moderate or significant gaps in how their recovery plans account for cloud infrastructure, SaaS applications, identity services, security tooling, third-party integrations and AI systems.
For Karam, that makes resilience a design principle rather than an add-on. “Cyber resilience increasingly has to be an architectural principle because the modern enterprise is deeply interconnected,” he says. “Recovering one application in isolation may not restore the business.”
He points to India’s most digitally intensive sectors as the places where this matters most, naming BFSI, manufacturing, healthcare and telecom. In banking and financial services, the trap is stopping too early.
“Recovery cannot stop at restoring core applications if identity systems, customer-facing services or critical third-party dependencies remain unavailable.” In manufacturing, the exposure extends further: “the challenge extends to the systems and dependencies that connect business applications with operational environments and supply chains.”
The common thread across sectors, in his view, is a blind spot about dependencies. “Across these sectors, the common gap is often understanding how these dependencies affect the ability to recover an end-to-end business service.” The remedy starts with mapping those dependencies and designing for recoverability from the outset. “That means protecting data across environments, securing identity and access, maintaining immutable recovery copies and having an isolated recovery environment available when needed.”
He reduces the shift to a single change in the question leaders ask. “The question for Indian enterprises is no longer simply, Do we have a backup? It is, Can we recover the business safely if the systems and infrastructure we normally depend on cannot be trusted?”
The AI preparedness gap
The most striking statistic in the report concerns the threat on the horizon. A full 83% of organisations said their recovery plans would need moderate or significant changes to withstand attacks involving frontier AI capabilities. Only 3% said their current plans are equipped for those conditions.
Karam says the concern is about tempo as much as sophistication. “AI is changing the speed, scale and sophistication of cyberattacks. As AI capabilities become more accessible, attackers can potentially automate reconnaissance, vulnerability discovery and parts of the attack chain, compressing the time organisations have to detect and respond.”
The implication for recovery architecture is that the definition of what needs protecting has to widen. “Organisations will need to consider AI models, data, configurations, identities and increasingly autonomous agents as part of their recovery strategy.” The same technology also works in the defender’s favour, he notes, by helping organisations “detect anomalies, investigate incidents and accelerate recovery processes.” But speed is not the goal. “The goal is not simply to recover faster, but to ensure that recovery remains secure and controlled as the attack environment becomes more complex.”
From improvised response to a governed process
Many enterprises have the pieces of a clean-room recovery on paper and few have them assembled and rehearsed. Cohesity’s answer, in partnership with HCLTech, is to bring its Clean Room capabilities into a managed-services model through the HCLTech VaultNXT offering.
The shift, Karam says, is from improvisation to repeatability. “The biggest change is that clean-room recovery becomes a repeatable and governed part of the recovery process rather than something teams have to put together during a crisis.” For customers, that means “a defined path to investigate an incident, validate recovery data and bring critical workloads back without exposing production environments to the same threat.”
The integration combines Cohesity Clean Room and its AI-powered data security capabilities with VaultNXT inside a managed cyber-resilience framework. According to Karam, this gives organisations “policy-driven cyber vaulting, immutable recovery copies, governed access and an isolated environment where recovery can be investigated and validated.” The model is aimed at organisations that would rather not assemble all of this themselves. “For organisations that do not want to build and operate all of these capabilities themselves, the managed model can provide greater repeatability and governance.
Ultimately, it is about giving customers a more structured and controlled route from a cyber incident to validated recovery and the resumption of business operations.”
What a real recovery exercise should test
If most organisations are practising the wrong thing, what should they practise instead? Karam is direct. “A meaningful cyber-recovery exercise should test whether the business can continue operating, not simply whether IT can restore its backups.”
That means rehearsing the entire chain: “identifying the right recovery point, establishing an isolated environment, restoring identity and access, validating applications and dependencies, addressing security issues and bringing critical services back in the right sequence.” It also means including third parties, because “an organisation may recover its own infrastructure and still be unable to operate if a critical external service is unavailable.”
The Minimum Viable Company concept gives the exercise its scope, and the report shows how rarely it is applied. Karam notes that “only 22% have both documented and tested how critical operations would continue during recovery.” His advice is to build exercises around the questions the business actually cares about. “Can customers transact? Can employees work? Can critical services operate?”
He closes the point with a distinction that could serve as a litmus test for any existing programme. “If the exercise only proves that data can be restored, it has tested backup recovery, not cyber resilience.”
The next three years: More managed, More automated, More accountable
Looking ahead, Karam expects resilience to become “more integrated, automated and closely aligned with business continuity.” The complexity of modern environments, combined with increasingly capable attackers, makes it hard for any organisation to manage every aspect of recovery alone. That, he predicts, “will drive greater adoption of managed cyber-resilience services, particularly for capabilities such as cyber vaulting, clean-room recovery, investigation, recovery orchestration and resilience testing.”
He is careful to say that the role of a managed provider should not stop at restoring data. “It should help organisations establish a repeatable and validated path back to business operations.” Cohesity’s own approach, he says, is built around this broader view: “protecting data, identity, applications and agents; understanding risk; establishing trusted recovery environments; and practising recovery so that teams are not improvising during an attack.”
For leaders who want a standard to measure themselves against, Karam offers three demonstrations. “CIOs and CISOs should be able to demonstrate three things: they know what must be recovered, they have a trusted way to recover it, and they have tested that recovery under realistic conditions.”
The bottom line for CIOs
The numbers in Cohesity’s report describe an industry that has spent years perfecting the mechanics of backup and is only now confronting what comes after. Seventy-eight per cent are focused on restoring systems. Sixty per cent of those hit by a material attack were slowed by doubt about whether their restored data was safe. Eighty-three per cent expect AI-driven attacks to force a rethink of their plans, and just three per cent believe they are ready.
None of those figures says that backups have failed. They say that backups were never the whole answer. The organisations that will recover fastest from the next serious incident are unlikely to be the ones with the most copies of their data. They will be the ones that decided in advance what the business cannot live without, mapped the dependencies behind it, found a trusted place to validate their data and rehearsed the whole sequence until it stopped being improvisation.
The next time a board asks whether the organisation is protected, the honest answer may no longer be a count of backups or a recovery time for a server. It may be a demonstration, under realistic conditions, that customers can still transact, employees can still work and critical services can still run. As Karam puts it, resilience is the ability to prove it.