The Vendor Retention Window Wasn’t a Recovery Control
A vendor retention window describes what the custodian intends to do. It does not establish that you hold a copy the custodian cannot touch.
-
-
The Ransomware Takedown Closed the Actor’s Infrastructure. It Didn’t Close Your Exposure.
A ransomware takedown changes what an attacker can do next; it does not tell a victim what was taken, who holds copies, or whether its exposure is closed. On 30 September 2026, law enforcement took control of the KillSec leak site and secured at least 110 terabytes of stolen data against further unauthorised access, according…
-
Your Ransomware Recovery Plan Has a Recoverability Gap
The recoverability gap is the structural distance between what your recovery plan assumes and what your infrastructure can actually deliver under failure conditions. Most organizations don’t discover it during planning. They discover it on day three of an incident. The ransomware tabletop passed. The backup dashboard was green. The recovery runbook was approved. Day three…
-
Your DR Test Passed. The Assumptions Didn’t.
DR plan failure rarely happens where you tested. It happens at the assumptions the exercise never reached — the dependencies that weren’t in scope, the runbook written for last year’s architecture, the authority chain nobody tested at 2am.
-
-
-
The Configuration Drift Discovery During a Drill
Quarterly recovery drill. Backup job green for four months. Restore executes cleanly — data intact, VM boots, database service starts. The application fails on the first transaction. Three hours disappear into backup triage before anyone checks the environment. The backup was not the problem. It never was. This is recovery configuration drift — and it…
-
Rubrik vs Cohesity: The Enterprise Decision Framework
Most enterprise backup evaluations do not stall because one platform fails technically. The rubrik vs cohesity decision stalls because both pass — and then the evaluation committee realizes it has been asking the wrong question. Both platforms cleared restore testing. Both cleared immutability review. Both satisfy ransomware posture requirements. Both have credible cloud support stories….
-
The Connected Air Gap: Why Most Backup Isolation Fails
Most backup architectures marketed as air-gapped are not isolated. They are reachable systems with better storage controls. Shared identity, shared control plane, scheduled connectivity, and immutable-but-addressable storage all produce the same outcome: production compromise can still destroy recovery without touching backup data. Data protection and blast-radius isolation are different architectural properties. Data protection answers whether…
-
Incident Recovery Process: Why the Incident Isn’t Over After Restore
THE RECOVERY ENGINEERING SERIES PART 01 The Retry Storm Is a Self-Inflicted DDoS LIVE PART 02 Incident Recovery Process: Why the Incident Isn’t Over After Restore YOU ARE HERE PART 03 Recovery Ends the Outage. It Doesn’t End the Incident. LIVE PART 04 The Degradation Ladder: How Systems Fail Before They Fail LIVE The restore…
