iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
There is no independent statistic showing that nearly half of all organizations fail a standardized cyber-continuity test. The often-cited “nearly half” figure comes from a 2024 Cohesity-commissioned survey: 45% of respondents said their target recovery time was two hours or less, but only 2% said they could recover data and restore business processes within 24 hours. Those figures describe different measures, not a two-hour pass/fail test. More recent UK government data adds another warning sign: only 33% of businesses reported having a continuity plan covering cyber security.
What the “nearly half” claim actually measures
Cohesity commissioned Censuswide to survey 3,139 IT and security decision-makers in Australia, France, Germany, Japan, Malaysia, Singapore, the UK and the US from June 27 to July 18, 2024. The results are self-reported and commercially sponsored; they are not a representative census or a standardized exercise conducted against every organization.
| Question in the Cohesity survey | Reported result | What it tells you |
|---|---|---|
| What was the organization’s optimum recovery-time objective? | 98% said within one day; 45% said within two hours | An intended target, not demonstrated performance |
| How quickly could the organization recover data and restore business processes? | 2% within 24 hours | A reported capability window, still not an observed test result |
| Expected recovery time | 18% said 1–3 days; 32% said 4–6 days; 31% said 1–2 weeks; 16% said more than three weeks | Many respondents expected restoration to take substantially longer than their target |
| Stress-tested data security, management and recovery processes in the previous six months | 49% | Whether a recent exercise occurred, not whether it passed |
The gap between a two-hour objective and a recovery capability measured at 24 hours or longer is serious, but it does not prove that 45% failed a two-hour test. Recovery objectives, respondent estimates and tested outcomes must be reported separately.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →
Brian Spanswick, Cohesity’s CISO and CIO, described destructive attacks such as ransomware as a “when” rather than “if” threat and called recovery of business-critical data the most vital element of cyber resilience. Those are statements from the company’s release, not independent statistical conclusions.
How prepared are organizations to continue after an attack?
UK businesses: plans are far from universal
The UK Department for Science, Innovation and Technology’s Cyber Security Breaches Survey 2025/2026 found that 33% of businesses and 20% of charities reported a business continuity plan covering cyber security. The result measures whether respondents said a plan exists; it does not show that the plan works during ransomware, data destruction or prolonged system loss.
| UK business size | Reporting a cyber-focused continuity plan |
|---|---|
| Micro | 29% |
| Small | 44% |
| Medium | 73% |
| Large | 85% |
The same survey reported that 74% of businesses used secure cloud backup, 47% used two-factor authentication and 25% had a formal incident-response plan. A backup or authentication control helps reduce risk, but neither demonstrates that critical services can be restored in the required order.
Why other surveys produce different percentages
The Business Continuity Institute reported in 2023 that 87% of its respondents had continuity arrangements for cyber incidents. That higher figure is not a contradiction of the UK government’s 33%: the surveys use different countries, samples, methods and question wording. BCI’s 2025 findings also showed 45.5% treating resilience as a standalone function, up from 39.4% in 2023. Always identify the population and exact question behind a percentage.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
Why a written plan can still fail in practice
Targets are not evidence
An RTO (recovery time objective) states how quickly a process must resume. It is useful only when an exercise has demonstrated that people, access, clean data, infrastructure and suppliers can meet it. An RPO (recovery point objective) states how much data loss is acceptable. The appropriate RPO depends on the process and its business impact; there is no universal value supplied by these surveys.
Recovery is a business process, not only an IT task
Restoring servers does not automatically restore payroll, order fulfilment, clinical work, customer support or communications. A workable plan assigns decisions and fallback procedures across security, IT, continuity, legal, finance, communications, operations and executive leadership. BCI identifies organizational silos as a risk and emphasizes training and scenario exercises across teams.
Rank #3
Dependencies are easy to omit
Critical services may rely on identity systems, networks, SaaS platforms, specialist staff, facilities, suppliers and customer-facing channels. Documenting only internal applications can produce a technically successful restore that still leaves the business unable to operate.
How to test whether your recovery plan is credible
- List the services that must continue. Start with customer, safety, revenue, regulatory and staff-critical processes rather than a list of machines. Name the process owner and the systems, data, people and suppliers it depends on.
- Set an RTO and RPO for each priority process. Record the business consequence of missing the target and the maximum tolerable data loss. Do not copy a generic two-hour objective without proving that the process requires it and can support it.
- Define a clean restoration decision. Specify who determines that backups, identities, endpoints and applications are safe to use after compromise. Record validation checks and the approval needed to return a service to production.
- Exercise the plan with the right people. Run a scenario that includes security, IT, continuity, operations, communications, leadership and relevant suppliers. Test degraded operation, unavailable credentials, delayed vendors and customer notification—not just backup retrieval.
- Measure elapsed time and data loss. Capture when detection, containment, restoration and business resumption occur. Compare observed times with each process’s RTO and compare recovered data with its RPO.
- Fix and retest. Assign owners and deadlines for every failed step, update contact details and access paths, then repeat the exercise. A plan that has not changed after an exercise is documentation, not demonstrated capability.
Questions to ask when comparing recovery approaches
| Decision area | Evidence to request |
|---|---|
| Recovery time | Which critical processes have a measured RTO, and what date and scenario produced the measurement? |
| Data-loss tolerance | What RPO applies to each critical data set, and how is it verified? |
| Restoration integrity | How are restored data, identities, systems and endpoints checked before production use? |
| Coverage | Does the plan include people, facilities, suppliers, customer operations and communications as well as IT? |
| Exercise evidence | When was the last cross-team rehearsal, what failed and which changes were completed afterward? |
| Isolation and access | Can recovery be performed if production credentials, networks or management tools are compromised? |
Industrial and operational technology needs a different recovery lens
Office-IT assumptions do not transfer directly to factories, utilities, transport systems or other operational technology. In the SANS Institute’s 2025 worldwide survey of more than 330 industrial cybersecurity professionals, nearly half of incidents were identified within 24 hours, while almost one in five took more than a month to remediate. These findings concern ICS/OT environments, not all organizations.
In those settings, restoration can affect physical safety, process integrity and equipment availability. SANS instructor and report author Jason D. Christopher summarized the requirement: “Safe restoration in an industrial environment is complex and highly dependent on rehearsed procedures, verified access paths, and coordinated decision making.” Recovery plans should therefore involve control engineers, safety staff, plant operators and equipment vendors, with explicit conditions for safe shutdown and restart.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.A practical minimum for a small organization
A small business does not need a large continuity department to begin. It does need a short, owned and exercised plan. Write down the few services whose loss would stop trading, identify who can authorize recovery, record where clean backups and emergency contacts are held, define customer and staff communications, and rehearse the first day of an attack. The UK survey’s qualitative research included a small-business owner asking for a simple guide to what businesses need to consider; simplicity is useful when it produces action rather than leaving responsibilities vague.
Best Value
Use a planning workbook or similar checklist as a prompt, not as proof of readiness. The proof is an exercise that records whether the business can restore the processes customers and staff actually depend on.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
