Ransomware recovery is a rehearsal problem

In post-incident reviews, the difference between a two-day outage and a two-week outage is almost never the presence of backups. It is whether anyone has restored from them under pressure, with the identity systems the restore depends on also unavailable.

We recommend a quarterly rehearsal with three hard constraints: the primary domain is assumed compromised, the runbook must be readable offline, and the clock is public. Teams discover their real recovery-time objective within the first hour.

Incident Response & Business Continuity students run exactly this exercise in our lab environment, then write the after-action report — because the report, not the restore, is what changes budgets.