5 cyber resilience questions every IT leader should ask during Cybersecurity Awareness Month

Backups alone are not enough – recovery copies need to be protected and tested, while recovery processes must be fast enough to meet the needs of critical systems.

Dell PowerProtect One is designed to address those pressures, bringing protection and recovery operations into a unified experience that helps businesses protect data across increasingly distributed IT environments.

TL;DR

• Backups are only useful if they can be reliably restored when the business needs them most
• Recovery plans should account for how quickly critical systems need to return – not just whether recovery is technically possible
• Recovery data itself needs protection from ransomware and other attacks targeting backups
• Centralized management can reduce the operational burden created by fragmented protection tools and workflows
• A cyber resilience strategy should work across a mixed IT environment without forcing unnecessary infrastructure changes or vendor lock-in

1. Can you prove your backups are recoverable?

A backup has no measurable value unless the business can successfully restore operations from it. Successful backup jobs may show that data has been protected, but they do not necessarily prove those copies will work when recovery is needed.

Dell’s Cyber Resilience Insights survey tells the story: more than half (57%) of organizations failed to contain and recover effectively during their last test or cyber incident, while 63% say they overestimate their readiness for a major cyber event.

Regular restore testing helps expose problems early and gives IT teams a much better sense of whether their recovery plans will hold up under pressure.

Recovery needs to be tested, not assumed

Every leader believes their organization can recover from an attack, right up until the moment they actually need to. That confidence often rests on a policy document rather than proof, and the difference becomes painfully clear during a live incident.

When you assume recovery works, you're gambling with the numbers that matter most: revenue lost by the hour, contracts left unmet, and the customer trust that took years to build. The gap between how long you think recovery will take and how long it truly takes is where the real damage lives.

Restore from a compromised backup and you risk reinfecting the very systems you're fighting to bring back online. And here's what leadership too often overlooks: getting your data back isn't the same as getting your business back.

True recovery means restoring full operations, from applications to infrastructure, so your people can work and your customers can count on you. Resilience isn't a promise you make on paper. It's a capability you prove through practice, so when disruption strikes, confidence replaces guesswork

2. Can you recover the right systems fast enough?

Successful restores also need to happen within the time the business can tolerate. IT teams need to know how quickly critical systems can be brought back online and how much recent data the business can afford to lose.

Recovery time objectives (RTOs) and recovery point objectives (RPOs) put those requirements into measurable terms, but they’re only useful if recovery plans can actually meet them under pressure.

Recovery priorities need to match business priorities

When disruption strikes, recovery becomes a business decision long before it becomes a technical one. Here's the strategic truth many leaders miss: your recovery plan is really a statement of priorities. Restore systems in the wrong order, bringing back internal tools while your revenue engines, customer-facing platforms, and compliance-critical operations sit dark, and a contained technical event quickly escalates into a full business crisis.

That's why recovery time objectives and recovery point objectives can't be set for IT convenience. They should map directly to business outcomes: what generates revenue, what protects customers, and what keeps you compliant.

Start by defining your minimum viable business, the smallest set of processes you need to keep operating, then sequence recovery around it. The cost of getting this wrong is measured in more than downtime. It's measured in lost revenue, broken commitments, and eroded trust that takes years to rebuild.

When recovery priorities reflect business priorities, you turn a moment of crisis into a demonstration of resilience, protecting what matters most and getting back to business with confidence.

PowerProtect One can monitor service-level objectives and identify RPO violations, helping teams see where protection is falling short of defined targets.

3. Would your recovery data survive the attack?

Ransomware can target backups as well as production systems, giving attackers a way to remove an organization’s route back to normal operations. Recovery data, therefore, needs its own protection, with controls that make stored copies harder to alter or delete even if other parts of the environment have been compromised.

Many organizations are already moving in this direction, adopting isolated recovery environments (IREs) as a response to the growing threat of ransomware targeting backups directly. But adoption isn’t always enough. Indeed, “According to the Gartner® IT Resilience Survey for 2026, 78% of the respondents indicated that their organizations have already implemented or are in the process of implementing IREs.

However, among those who have already implemented or are in the process of implementing IRE of some kind, 53% do not have immutable backups and/or gold images.”*

Protect the recovery path itself

Dell PowerProtect One is built on the combined strengths of PowerProtect Data Manager and PowerProtect Data Domain. PowerProtect One brings forward the inherited resilience capabilities of Data Domain such as data immutability and retention locking technologies.

PowerProtect One is a cyber recovery vault source enabling replication of business-critical data into a dedicated PowerProtect Cyber Recovery vault that isolates protected copies from the production environment. Anomaly Detection can also help flag unusual patterns in backup metadata that may point to ransomware activity.

None of this replaces wider endpoint or network security, but it can make the recovery layer much harder for an attacker to disrupt.

4. How much time is protection management consuming?

Cyber resilience becomes harder to achieve when IT teams are moving between different consoles and protection tools. The problem is not just administrative overhead – fragmented management consoles and tools can make policies less consistent and recovery more difficult to coordinate when time is tight.

Simplify the day-to-day work around resilience

PowerProtect One is designed to bring management into one place, with centralized visibility across registered systems and policy-based protection for supported workloads.

The Unified Dashboard within PowerProtect One looks across connected systems and can surface health, protection coverage, alerts, and job activity, giving teams a clearer view of where attention is needed. Reducing manual coordination around backup and recovery can free up time while making protection easier to manage across the environment.

5. Can your protection strategy span the whole IT environment without locking you in?

Most enterprise IT environments already stretch across multiple platforms and locations, often combining legacy systems with newer infrastructure. Cyber resilience, therefore, needs to work across what’s already in place, rather than depending on everything fitting neatly into a single stack.

Integration matters more than consolidation

PowerProtect One is designed with an open and integrated architecture that offers:

• Support for a broad range of workloads across a variety of locations
• Compatibility with existing backup tools, removing vendor lock-in
• Integrated data reduction efficiently reduces the storage footprint of protected data.
• A unified cyber resilience platform that brings together management, orchestration, and secure protection storage into a single, intelligent experience

An open and integrated approach can reduce the pressure for wholesale infrastructure replacement while preserving more flexibility over future technology choices, which matters for procurement teams trying to simplify cyber resilience without committing the business to a single technology stack.

If you think Dell PowerProtect One is the right solution for your business, find out more on the Dell website.

FAQs

What is cyber resilience?

Cyber resilience is an organization’s ability to keep critical services running or recover them quickly when cyber incidents disrupt normal operations.

How often should businesses test their backups?

Backups should be tested regularly enough to prove that recovery works in practice, with the exact schedule shaped by how critical the systems and data are.

What is the difference between backup and recovery?

Backup creates recoverable copies of data, while recovery covers the wider process of restoring systems and returning the business to operation after an outage or attack.

* Gartner, IT Resilience Survey for 2026: Ransomware Recovery and Readiness, 15 September, 2025. GARTNER is a trademark of Gartner, Inc. and/or its affiliates.