Beyond backups: Can businesses recover from a major cyberattack?

A business may have several copies of its data and still be unable to resume operations after a serious cyberattack. Restoring files addresses one part of recovery, while rebuilding trusted systems, reconnecting applications and recovering access to essential services can take considerably longer. The distinction has returned to the forefront following a warning from the Bank of England about the need for stronger cyber-recovery capabilities.

On 15 October 2026, Deputy Governor Sarah Breeden discussed deep cyber-recovery options, including the possibility of rebuilding core banking systems from clean foundations when existing infrastructure cannot be trusted. Her comments concerned financial institutions and the growing risk of AI-enabled attacks, but they raise a wider operational question for managed service providers (MSPs), cybersecurity businesses and IT support teams responsible for recovering customer environments.

Why recovery is attracting renewed attention

The Bank of England has been considering the resilience of interconnected technology for some time. Its July 2026 Financial Stability Report warned that advances in frontier AI could increase the speed and scale of cyber exploitation, making severe disruption across multiple organisations more credible. The report highlighted isolated rebuilding environments and substitute facilities as options worth considering for systems supporting important financial services. These options remain under consideration and have not created universal new obligations for technology suppliers.

The same theme appeared in the Bank's October sector-wide exercise, SIMEX26, which examined a global cloud services disruption. Thirty-eight of the largest and most systemically important banks and market infrastructure operators participated alongside financial authorities. The exercise focused on coordination when a major dependency becomes unavailable, and the Bank subsequently called on participants to strengthen their ability to respond to severe operational and cyber incidents.

The difference between restoring data and restoring services

A backup may preserve customer records, documents and databases in good condition. A usable business service also requires functioning applications, identity and access systems, configuration, networking, integration points and people with authority to bring those elements back into operation. When a server is lost through hardware failure, much of the surrounding environment may remain trustworthy. A sophisticated cyberattack introduces the possibility that the surrounding infrastructure has also been compromised.

For example, restoring a company database achieves little if its identity provider remains unavailable, the application server still contains malicious code or engineers cannot verify that privileged credentials have been replaced. A successful restore test might confirm that a file opens or that a database can be mounted, while leaving the end-to-end business process untested. Recovery therefore depends on the state of the complete service and the evidence available to establish that it can be operated safely.

What a clean recovery environment needs

The National Cyber Security Centre's recently published technical recovery guidance describes the importance of accessible asset information, protected backups and tested restoration processes. It explicitly includes identity systems, trust infrastructure, applications, data and configuration among the elements that backups may need to support. A clean recovery environment enables teams to restore those components without immediately exposing them to the same compromised systems or administrative accounts.

A separate environment may include isolated infrastructure, new administrative credentials, trusted installation media and validated configuration records. The right design will vary with the organisation's architecture and critical services. In some circumstances, an isolated virtual environment may be appropriate, while other scenarios call for rebuilding underlying hosts or entire platforms. A bare-metal rebuild is one approach to restoring trusted foundations, but it does not by itself guarantee the safe return of business operations.

Why attackers target the recovery process

Destructive attacks frequently extend beyond the visible encryption of production files. The NCSC's ransomware-resistant backup principles explain that attackers may attempt to delete backups, alter stored copies or compromise infrastructure so that restoration becomes harder. Accounts used to administer backup platforms and keys needed to decrypt protected data can be valuable targets because compromising them undermines the organisation's ability to recover.

Segregated permissions, protected retention and independently accessible copies can help preserve recovery options, although their effectiveness depends on implementation and testing. The NCSC also emphasises the ability to restore an earlier clean version if later backups have become corrupted. That can matter when an attacker has remained inside an environment before the incident is detected. The most recent backup may contain unwanted changes, and recovering safely could require an earlier restore point and careful reconciliation of legitimate work completed since then.

Identity and trust are central to restoration

Business services often depend on centralised authentication, certificates, directory services and privileged management accounts. Those dependencies can simplify normal operations while making recovery more complicated after a widespread compromise. Restoring a directory from backup may reintroduce compromised credentials or configuration if the attacker had sufficient access before the selected restore point. Teams need a way to establish which identities and trust relationships remain valid as systems return.

Those dependencies influence the sequence in which recovery work can safely proceed. Infrastructure may need to be isolated and verified before business applications are restored, while access arrangements must be rebuilt in a sequence that avoids granting attackers entry to the new environment. The dependency map extends to externally managed email, cloud administration, remote monitoring tools and identity federation. Technology service providers should understand those relationships because their own administrative platforms may be critical to several customer environments at once.

Recovery priorities depend on business impact

An organisation can have technically successful backups and still face unacceptable disruption if it restores the wrong systems first. Customer-facing services may depend on a chain of internal components, and each link can influence the order in which recovery work is performed. The Bank of England's operational resilience framework focuses on important business services and the ability to withstand severe but plausible disruption, including failures involving external technology suppliers.

That principle has wider relevance even where a business falls outside financial regulation. A manufacturer may need production scheduling before historical reporting, while a professional services firm may need secure client communications and its case-management system before less time-sensitive internal tools. Recovery-time objectives and acceptable data loss should reflect those operational dependencies, with practical alternatives available when full restoration will take longer than expected. These decisions require business owners and technical teams to share an understanding of which outcomes matter most.

What testing actually demonstrates

Tests that restore individual files or servers provide valuable evidence about backup integrity and particular recovery steps. Broader exercises examine whether people can identify the affected systems, make decisions with incomplete information and restore services when production access has been removed. The NCSC's response and recovery assessment guidance includes exercises that cover the full response cycle and use the findings to improve plans.

A realistic exercise might assume that normal administrator accounts are unavailable, the helpdesk platform is inaccessible and an important third-party system is offline. Engineers would then need to locate recovery documentation, establish trusted access and confirm that restored services are safe for users. These exercises can reveal missing prerequisites that routine backup reports would never identify. They also establish whether recovery plans remain workable after changes to applications, suppliers and infrastructure.

The implications for technology service providers

Managed IT and cybersecurity providers may hold the technical knowledge needed to restore multiple customers, but their recovery capability can depend on shared tools, a limited number of specialists and the availability of external services. An incident affecting a management platform could create simultaneous demands across customers. These concentrations are especially relevant when assessing software supply-chain dependencies and deciding which systems need independent restoration paths.

There is also a distinction between the capabilities written into a contract and the operational steps that have actually been demonstrated. An agreed backup frequency may describe data protection, while recovery testing reveals whether a complete service can be restored within the customer's required timescale. Providers and customers benefit from clear ownership of these decisions, including who authorises restoration, who validates recovered information and who communicates when a service can resume. Existing discussion about IT support resilience becomes particularly relevant when recovery depends on several organisations working together.

Main Takeaway

The Bank of England's recent warning highlights a practical distinction between possessing recoverable data and having the capability to restore trusted business services after a major compromise. Protected backups remain essential, but the recovery process also depends on identities, infrastructure, applications, service dependencies and coordinated decisions. The Bank's work on isolated rebuilding and sector-wide disruption shows why these questions are receiving greater attention as cyber threats evolve.

For technology service providers, the relevant measure is whether a recovery approach can function under the conditions of a serious incident. Evidence comes from realistic tests, verified restore points, defined responsibilities and an understanding of which services must return first. Those capabilities determine how quickly customers can regain safe, dependable operations when their normal systems can no longer be trusted.