A ransomware attack can leave an organization with a problem more difficult than encrypted files: the systems used to establish trust may also be compromised.
If attackers gain privileged credentials, compromise Active Directory, or reach backup infrastructure, recovery is no longer simply a matter of finding a clean copy of data and restoring it. The organization first has to establish whether the identities, access controls and recovery tools required for restoration can themselves be trusted.
The risk is increasingly visible in real-world attacks. Sophos reported that 79% of ransomware attacks in 2025 involved compromised identities, while the average recovery cost reached $1.7 million. The 2023 MGM Resorts attack also demonstrated how compromise of identity and access pathways can quickly become an operational crisis, disrupting systems across the business. For CIOs, the recovery question therefore changes from “Can we restore our data? to “Can we establish a trusted path back to operations?”
Recovery Has to Rebuild Trust First
In a conventional infrastructure failure, administrators can generally rely on their authentication and management systems. A cyberattack removes that assumption. If privileged accounts or Active Directory have been compromised, restoring applications without first rebuilding trusted identity can leave the organization operating on top of the same compromised access structure.
The UK National Cyber Security Centre (NCSC) explicitly identifies trusted identity as a critical recovery dependency, recommending that organizations be prepared to rebuild identity systems and reset privileged credentials before broader restoration.That principle extends to the backup environment as well. A backup can remain intact while the organization loses the ability to securely access or restore it.
A Protected Backup Is Not Enough
Immutable backups remain essential because attackers increasingly target recovery infrastructure itself. NCSC guidance recommends isolation, separate credentials, least privilege and controls that prevent unauthorized deletion or modification.
But there is a crucial difference between, having a clean backup and being able to recover from it
The Caesars Entertainment breach illustrates why access pathways matter. A social-engineering attack targeting an outsourced IT support vendor gave attackers access to the company’s network and resulted in the theft of customer data. The incident showed how a compromise of an identity or administrative pathway can become an enterprise-level security problem. If corporate identity is unavailable after an attack, recovery teams need an independent and trusted way to reach backup infrastructure. NCSC’s cloud-backup guidance therefore recommends out-of-band access so backups remain reachable even when normal corporate systems are unavailable.
The next challenge is deciding where those backups should be restored.
Recovery Needs Its Own Trust Boundary
Restoring systems directly into a compromised production environment can recreate the conditions that allowed an attacker to persist. An isolated or clean recovery environment gives teams a controlled space to validate recovery points, rebuild identity and foundational services, and progressively restore workloads. NCSC guidance also recommends checking backups for compromise and using known-clean systems during restoration.
The objective is not simply to bring servers back online. It is to restore trusted business capability without allowing the original compromise to follow it back into production. That requires more than a secure recovery environment. It requires knowing which systems and services the business actually needs first.
Recovery Speed Depends on Sequence
Enterprise applications rarely operate independently. Authentication, DNS, networking, certificates, databases and storage can support multiple business services So, restoring an application before its dependencies may therefore produce a technically functioning system that cannot actually support the business.
NCSC recommends mapping dependencies and prioritizing critical systems. This is where minimum viable operations (MVO) become important. Instead of attempting to restore everything simultaneously, organizations can first rebuild the trusted services required to resume critical business functions. For a bank, that might mean payments and customer access. For a manufacturer, production and supply-chain systems may take priority. Once that sequence is defined, orchestration can make it repeatable rather than dependent on decisions made under pressure.
Orchestration Makes Recovery Repeatable
During a major cyber incident, recovery teams are working under pressure and often with incomplete information. Relying entirely on manual decisions increases the risk of restoring systems in the wrong order or missing critical validation steps.
Recovery orchestration can predefine recovery groups, dependencies, access requirements and validation points. Its value is not automation for its own sake; it is consistent, controlled execution. But a documented or automated process is only useful if the organization knows that it works when normal infrastructure and identities are unavailable.
Test the Recovery Path, Not Just the Backup
A successful file restore does not prove that an organization can recover from an identity compromise. A meaningful recovery test has to go further: can the organization still establish administrative access if corporate identity is unavailable, reach its backup environment independently, rebuild Active Directory, identify a known-good recovery point, and bring critical business services online while the wider environment is still being reconstructed? These are the conditions that determine whether a recovery plan will actually work when the systems normally used to manage recovery are themselves compromised.
NCSC’s 2026 recovery guidance recommends realistic exercises, including failover, shutdown, restart and rebuilding from backups, because testing exposes weaknesses that documentation alone cannot reveal. For CIOs, that means measuring recovery by more than backup availability. The stronger measure is whether the organization can re-establish trust, rebuild critical dependencies and return to minimum viable operations without giving the attacker a route back in.
This is where Open Storage Solutions sees cyber recovery as an infrastructure challenge, not simply a backup exercise. Storage, identity, recovery environments and the systems that connect them all have to work together so that critical data remains protected, accessible and recoverable even when the surrounding production environment cannot be trusted.
The goal is not simply to have a backup when an attack happens, but to have a trusted, tested path from compromise back to business operations.
Add your first comment to this post