A cyberattack can show whether an organization can restore critical data and resume the services people rely on—not merely whether it has a recovery target on paper. A 2024 Cohesity-commissioned survey found a sharp gap between respondents’ stated recovery objectives and their reported recovery capability. But its figures do not prove that nearly half of all organizations failed a standardized continuity test: the survey was self-reported, and its target and capability measures used different time windows.
What the “nearly half” figure actually measures
The closest match to the headline is Cohesity’s 2024 Global Cyber Resilience Report. Censuswide surveyed 3,139 IT and security decision-makers in Australia, France, Germany, Japan, Malaysia, Singapore, the UK and the US from June 27 to July 18, 2024. Cohesity commissioned the survey, so its results are attributed, self-reported responses—not an independent census or observed pass/fail test.
As an Amazon Associate I earn from qualifying purchases.
Among respondents, 45% said their organization’s optimum recovery time objective was within two hours. Separately, 2% said their organization could recover data and restore business processes within 24 hours. Those figures signal a potential mismatch between ambition and reported capability, but they are not a direct comparison: the target was two hours, while the capability measure was 24 hours. It would be inaccurate to say that 45% failed a two-hour recovery test.
| Measure in the 2024 Cohesity-commissioned survey | Respondents’ answer | How to interpret it |
|---|---|---|
| Optimum recovery time objective within two hours | 45% | A stated target, not demonstrated recovery performance. |
| Optimum recovery time objective within one day | 98% | A stated target. The report does not make this a measure of successful recovery. |
| Could recover data and restore business processes within 24 hours | 2% | Respondents’ assessment of capability, not a standardized test result. |
| Expected recovery and restoration to take 1–3 days | 18% | Self-reported expected duration. |
| Expected recovery and restoration to take 4–6 days | 32% | Self-reported expected duration. |
| Expected recovery and restoration to take 1–2 weeks | 31% | Self-reported expected duration. |
| Expected recovery and restoration to take over three weeks | 16% | Self-reported expected duration. |
| Stress-tested data security, data management and recovery processes in the prior six months | 49% | Reported recent testing; the figure does not establish the test’s scope or whether it demonstrated the stated recovery objective. |
The distinction matters for decision-making. A recovery time objective (RTO) is the target time for restoring a system or business process. It is not proof that staff, systems and suppliers can meet that time during a disruptive incident. A recovery point objective (RPO) describes how much data loss, measured over time, the organization can tolerate. Neither target has a universal value that fits every organization; both need to reflect the consequences of an interruption to specific processes and data.
#1 Best Overall
How prepared are UK businesses?
The UK Department for Science, Innovation and Technology’s Cyber Security Breaches Survey 2025/2026 provides a separate, more recent indicator: whether an organization reports having a business continuity plan that covers cyber security. It found such a plan at 33% of UK businesses and 20% of UK charities. These are plan-presence figures, not evidence that the plans have been exercised or will work during an attack.
| UK business size | Reported a business continuity plan covering cyber security |
|---|---|
| Micro | 29% |
| Small | 44% |
| Medium | 73% |
| Large | 85% |
The same UK survey found that 74% of businesses reported secure cloud backup, 47% reported two-factor authentication and 25% reported a formal incident response plan. These measures describe different parts of readiness: backup can support restoration, authentication can help protect access, and an incident response plan can organize action. None, by itself, demonstrates that essential operations can be restored safely within the time the business needs.
Rank #2
Why a plan is not the same as recovery
Continuity depends on coordinated work across security, IT, business operations and the people responsible for critical services. A backup may exist but be unavailable when needed; a restored system may not yet be safe or usable; or teams may not know who can authorize decisions and communicate with customers. A plan that covers only technical restoration can miss dependencies such as suppliers, staff, customer-facing processes and the order in which services must return.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →The Business Continuity Institute (BCI) reported in 2023 that 87% of its survey respondents had continuity arrangements for cyber incidents. That does not contradict the UK government’s 33% figure: the surveys cover different populations and geographies and use different methods and wording. The BCI result is a professional-survey finding, while the government result concerns UK businesses reporting a plan that covers cyber security. Neither percentage establishes how well an arrangement performs under pressure.
Rank #3
BCI has highlighted organizational silos as a continuity risk and pointed to training and scenario exercises as ways to improve coordination. Its 2025 report announcement said 45.5% of organizations treated resilience as a standalone function, compared with 39.4% in 2023. That organizational measure is not a test of recovery effectiveness, but it underscores why responsibility and communication across functions need attention.
What a useful cyber recovery exercise should establish
A meaningful exercise should test the decisions and dependencies that determine whether critical work can resume, not just whether a backup job completed. Start with the services whose interruption would cause the greatest harm, then work through how their data, systems, people and supporting organizations would be restored.
Rank #4
- Set recovery objectives by process. Identify the time within which each critical activity must resume (its RTO) and the amount of data loss it can tolerate (its RPO). Record why those thresholds fit the business impact; do not adopt a single target for every system by default.
- Test against the objective. Rehearse the actual recovery steps for the process, record elapsed time and data restored, and identify what prevented the team from meeting its target. A documented objective is not evidence until the relevant steps have been exercised.
- Check restoration integrity and usability. Establish who verifies that recovered data and systems are safe and fit for use before operations depend on them. A successful copy or restart is not necessarily a safe return to service.
- Include business and external dependencies. Bring in the people who run affected processes, manage communications and make operational decisions, as well as relevant suppliers. Confirm who can authorize actions and how customer-facing work continues while systems are unavailable.
- Capture lessons and make changes. Record gaps, assign owners and update procedures, access arrangements or training as needed. BCI recommends training and exercising scenarios across teams; the value comes from correcting weaknesses the exercise exposes.
For a business that wants a plain-language starting point, the UK survey’s qualitative research includes a small-business owner asking for a “really simple” guide to what to think about. That is an interview comment, not a statistically representative finding, but it reflects the practical need to make continuity steps understandable to the people expected to use them.
Free tools Windows power users keep installed
One-click scans. No signup required.
Industrial and operational technology need a different recovery lens
Office systems and industrial control or operational technology (ICS/OT) cannot always be restored in the same way. Industrial environments may involve process equipment and safety considerations, so a technically available system is not automatically safe to restart. Recovery can depend on rehearsed procedures, verified access paths and coordinated decisions.
Best Value
- Used Book in Good Condition
A 2025 SANS Institute announcement, based on a worldwide survey of more than 330 industrial cybersecurity professionals, reported that nearly half of incidents were identified within 24 hours and almost one in five took more than a month to remediate. These findings concern ICS/OT environments, not businesses in general. They illustrate why organizations operating industrial systems should use sector-appropriate safety and restoration procedures rather than assume an office-IT recovery plan transfers unchanged.
Questions to ask before relying on a recovery plan
- Which customer, staff or operational processes must return first, and who decides their priority?
- What RTO and RPO apply to each of those processes, and when were the recovery steps last demonstrated in an exercise?
- Can the organization verify that restored data and systems are safe and usable before putting them back into service?
- Does the plan cover the people, suppliers, communications and customer-facing work needed to operate during an outage?
- Did the last exercise result in specific changes, with owners responsible for completing them?
Answers grounded in a recent, realistic exercise provide stronger evidence than a recovery target or plan document alone. The available survey figures show a gap worth examining, but they do not establish a universal rate at which organizations fail cyber continuity tests.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
