Cyber recovery plans lag behind AI, ransomware threats

Many organizations are building cyber recovery plans around outdated assumptions, leaving them poorly prepared for ransomware, AI-driven threats and increasingly complex infrastructure, according to Cohesity.

During an interview with Enterprise Security Weekly, Rob Sadowski, vice president of product and solution marketing at Cohesity, said research involving more than 3,200 security and IT leaders across 11 countries found 78% of organizations focus recovery plans primarily on restoring systems rather than restoring critical business operations.

That approach can overlook dependencies such as identity and authentication infrastructure that must also function before critical systems can return to service. Sadowski said organizations should instead identify a “minimum viable” set of applications, data and dependencies required to keep the business operating.

Only 37% of surveyed organizations had defined that minimum viable environment, and just 22% of those organizations had tested it. Actual recovery times following incidents were nearly twice as long — and sometimes more than twice as long — as organizations had planned.

AI is creating another gap. Fewer than half of organizations have formally incorporated AI systems into recovery plans, while less than half believe they have a strong inventory of where AI is used. Fewer than half also believed they could recover from the actions of a rogue AI agent.

Sadowski recommended that organizations define and test their minimum viable operations, incorporate business-critical AI into resilience planning and treat resilience as a continuous process requiring regular risk reassessment and testing.