Topic starter
09/07/2026 5:54 pm
TL;DR: Enterprises are split between comprehensive and staged recovery strategies, yet 54% lack confidence they can recover from a major disruption or cyberattack and only 46% feel very confident, according to Commvault and GigaOm research. The core problem is that recovery planning remains technology-led when business continuity demands business-first prioritisation.
Editorial analysis by NHI Mgmt Group, based on content published by Commvault: “The 54% Problem: Why Most Organizations Can’t Recover from Cyberattacks (And How to Fix It)”.
By the numbers:
- 54% of enterprises lack confidence in their ability to recover from a major disruption or cyberattack.
- Only 46% of enterprises feel very confident they could recover to full business operations after a major disruption.
- 96% of organisations surveyed support the minimum viable recovery approach.
Key questions
Q: What breaks when recovery planning is technology-led instead of business-led?
A: Technology-led recovery often restores the wrong things first.
Q: Why do enterprises with strong resilience spend still lack recovery confidence?
A: Because spending on infrastructure does not fix prioritisation.
Q: How do security teams know whether minimum viable recovery is actually working?
A: They should measure whether the organisation can restore its most critical services in the right order, with the right access, within tested service-level targets.
Practitioner guidance
- Define minimum viable business services Identify the smallest set of customer-facing, revenue-producing, and operational functions that must return first after a disruption, then map every supporting system and identity dependency to that set.
- Inventory recovery-critical identities Document which privileged users, service accounts, secrets, and access paths are required to restart core business processes, then test whether they can be restored under incident conditions.
- Replace technical restoration metrics Measure recovery against business capability thresholds such as order processing, payment flow, or customer support continuity rather than relying mainly on downtime and time-to-resolution.
Bottom line: The research shows that many enterprises still plan recovery around systems, even though business continuity depends on restoring the right functions and identities first.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 5:55 pm
Minimum viable recovery is really identity-enabled continuity planning: Recovery only works when the organisation knows which identities, access paths, and supporting services must return first. That is not a backup problem or a platform problem alone. It is a governance problem about what the business must be able to authenticate, authorise, and run before anything else can be considered recovered.
A question worth separating out:
Q: What should IAM teams do differently in recovery planning?
A: IAM teams should treat authentication and authorisation as recovery dependencies, not as separate control areas. That means identifying which accounts, secrets, and privileged pathways are required for first-wave recovery, and validating that they can be restored or reissued when the business needs them.
👉 Read our full editorial: Minimum viable recovery exposes the enterprise recovery gap