Alpine rebuilt its GitLab server without evidence of compromise because it could not rule one out. The rebuild-or-attest table shows what you must keep before an incident to make that call.
Rotation issues new secrets. Revocation removes the authority of everything that could have used the old ones. Whether you can do the second depends on a design decision made long before the incident: the revocation unit.
A restore can meet its RPO, pass every health check, and still return wrong answers. For AI workloads, the recovery point has to be defined by version lineage, not a timestamp.
A ransomware production shutdown doesn’t require touching a single machine on the plant floor. When ransomware hit Coca-Cola’s Fairlife operations, U.S. production was temporarily suspended after the company disclosed unauthorized third-party access to a portion of its systems, including production-related systems. Coca-Cola has not publicly established that plant-floor machinery itself was encrypted or disabled —…
Every recovery plan assumes a business survival window wide enough to outlast the outage it’s designed for — most never test whether that assumption holds, because the number that would prove it isn’t one recovery planning tracks. On March 29, 2026, a cyberattack hit ZEGO Textilveredelungszentrum, a 37-year-old German textile-finishing firm in Aschaffenburg. Production stopped…
Persistent access is one of the few compromise patterns that can survive a fully executed recovery. In August, researchers disclosed that attackers exploiting Microsoft Exchange Server had deployed a browser-based implant — internally documented as OWAReaper — that modified mailbox permissions in a way that outlasted both credential rotation and complete server rebuilds. The recovery…
A ransom payment ban doesn’t eliminate the ransomware business model by itself — it eliminates an option most recovery plans quietly assumed would still be there once everything else had already failed. The UK government confirmed in July 2025 that it will introduce a targeted ban on ransom payments by public sector bodies and critical…
Recovery bus factor is the gap between a recovery plan that has been tested, documented, and signed off — and a recovery plan that can actually be executed when the one or two people who know how to run it aren’t in the room. The recovery program had passed everything that mattered on paper: RTO…
Restore evidence is the artifact layer most disaster recovery programs never build — the difference between reporting that a restore succeeded and being able to prove it. Backup restored. Applications started. Users logged in. Test passed. Every one of those is a statement. None of them is an artifact. A Successful Restore Still Doesn’t Prove…
