Notifications
Clear all
Topic starter
09/07/2026 3:25 pm
TL;DR: Financial services organizations face more complex cyber recovery conditions than peers yet report stronger outcomes, according to Commvault research, with 63% seeing minimal or no data-loss disruption and 75% running quarterly or more frequent tests. The signal is that recovery discipline, not only tooling, now separates resilient programmes from fragile ones.
NHIMG editorial — based on content published by Commvault: Challenges in Meeting a High Bar for Cyber Recovery in Financial Services
By the numbers:
- 63% of FinServ organizations reported minimal or no disruption from data loss due to cyberattacks, compared to 53% in other sectors.
- 43% of FinServ organizations report extensive adoption of AI and ML-powered security technologies, versus 29% across other industries.
Questions worth separating out
Q: What breaks in cyber recovery when identity dependencies are not tested?
A: Systems may come back online while the organisation still cannot trust who or what has access to them.
Q: Why do financial services organisations place so much emphasis on recovery testing?
A: Because regulated, high-value environments cannot rely on theoretical plans.
Q: How do security teams know if cyber recovery readiness is actually working?
A: They can measure whether tests meet RTO and RPO targets, whether recovery exercises include identity revalidation, and whether critical systems restore without manual workarounds.
Practitioner guidance
- Inventory identity dependencies in recovery plans Document which IAM services, privileged roles, service accounts, and secrets must be restored before application restart, then test those dependencies in the same recovery exercise.
- Add credential revalidation to every cyber recovery test Require each test to confirm that restored credentials, tokens, certificates, and break-glass paths are valid, rotated where needed, and not reopening attacker access.
- Set recovery objectives by business-critical identity path Tie RTO and RPO targets to the systems that authenticate users, workloads, and administrators, not just to storage and compute recovery.
What's in the full article
Commvault's full article covers the operational detail this post intentionally leaves for the source:
- The survey methodology and respondent breakdown behind the financial services comparison, useful for interpreting how broad the recovery findings are.
- The five strategy areas in more detail, including how FinServ teams define aspirational SLAs and build testing cadences.
- The specific investment patterns behind parallel and high-availability systems, which matter when translating recovery goals into budget decisions.
- The full analysis of how AI and ML are being used as a force multiplier in recovery planning.
👉 Read Commvault's analysis of cyber recovery in financial services →
Financial services cyber recovery: what identity teams should notice?
Explore further
09/07/2026 3:44 pm
Financial services recovery maturity is increasingly an identity governance problem. The article shows that successful cyber recovery is not only about backups and uptime, but about restoring trustworthy access in the right order. If service accounts, privileged roles, and secrets are not explicitly governed in recovery design, the organisation can restore systems while preserving attacker pathways. Practitioners should treat identity restoration as a board-level resilience control.
A question worth separating out:
Q: Who should own cyber recovery decisions in a high-risk environment?
A: The business and security leaders who own risk should own recovery strategy, with the CISO typically responsible for translating that risk into testable controls. That includes prioritising which systems recover first, what access must be re-established, and which exceptions are acceptable during an incident.
👉 Read our full editorial: Financial services cyber recovery shows discipline beats complexity
