Topic starter
11/08/2026 3:11 pm
TL;DR: IDC’s Resilience Operations report says more than 500 North American organisations are moving from recovery metrics toward business outcomes, while nearly 6 in 10 still have not defined their minimum viable business and many remain dependent on manual recovery, according to Commvault. The shift matters because AI is compressing attack and disruption timelines faster than current resilience operating models can keep up.
Editorial analysis by NHI Mgmt Group, based on content published by Commvault: “What We Learned from IDC’s New Research on ResOps”.
Key questions
Q: How should security teams define minimum viable business for recovery planning?
A: Start by identifying the smallest set of services, data, processes, and approvals needed to continue operating after disruption.
Q: Why does AI make manual recovery less effective?
A: AI compresses reconnaissance, exploitation, and lateral movement into shorter windows, so manual recovery often finishes after the business has already absorbed the damage.
Q: What breaks when organisations have not defined a minimum viable business?
A: Recovery becomes reactive.
Practitioner guidance
- Define the minimum viable business Identify the smallest set of services, processes, data, and approvals required to keep operating after disruption.
- Automate recovery orchestration Replace manual recovery assembly with tested workflows for restore selection, validation, and coordination across security, infrastructure, and business teams.
- Include machine identities in continuity planning Map service accounts, workload credentials, tokens, and SaaS trust relationships into business continuity runbooks.
Bottom line: Resilience is shifting from technical recovery speed to the ability to restore business services in the right order.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/08/2026 3:25 pm
Business continuity is now the real resilience control. Recovery metrics still matter, but they no longer describe whether the enterprise can keep operating under stress. Once AI shortens the path from compromise to disruption, the question becomes whether the right business functions, identities, and dependencies can be restored in the right order. Practitioners should treat continuity design as a governance discipline, not a post-incident reporting exercise.
A question worth separating out:
Q: How should continuity planning account for machine identities and SaaS dependencies?
A: Treat service accounts, workload credentials, tokens, and third-party trust relationships as recovery dependencies, not just access controls. If those identities are missing, expired, or restored out of sequence, applications may be technically online but still unable to authenticate, exchange data, or resume transactions.
👉 Read our full editorial: ResOps is shifting resilience from recovery metrics to business continuity