Cohesity, an AI-powered data security specialist, has published a report titled “Cyber Recovery Plans Were Not Designed to Handle Today’s Reality”. Based on a survey of 400 French respondents, the study highlights a gap between the assumptions underpinning recovery plans and the reality of modern attacks.
- Le rapport de Cohesity montre que les plans de reprise reposent sur des hypothèses dépassées.
- Dans 85 % des cas, la reprise dépasse le RTO et dure deux fois plus longtemps que prévu.
- Les entreprises visent la restauration des systèmes, mais seules 23 % ont testé une Minimum Viable Company.
- L’IA se déploie plus vite que les plans : 98 % l’utilisent, mais 33 % seulement jugent leurs plans adaptés.
These plans, which describe how to bring systems back online after a cyberattack, are based on five common assumptions, according to the report. These include the idea that incidents can be fully contained before recovery begins, or that recovery will proceed in a largely linear, step-by-step fashion. In total, 94% of French organizations surveyed report relying, at least to some extent, on these assumptions.
However, reality contradicts them. Among French organizations that experienced a material cyberattack in the last 12 months, 62% saw the scope of affected systems expand beyond their initial assessment during recovery. The report defines a “material” cyberattack as a deliberate attempt to compromise, disrupt, or gain unauthorized access to systems, networks, or data, resulting in a measurable financial, operational, reputational, or customer impact. For 85% of the affected organizations, the actual recovery exceeded their Recovery Time Objective (RTO), i.e., the set timeframe for restoring a service, and took on average twice as long as planned.
Restoring Systems Is Not Enough to Resume Business
The report points to a persistent confusion. 70% of French respondents acknowledge that their plans focus more on restoring systems than on maintaining critical operations and customer service. About half of organizations that suffered an attack report moderate or significant delays after technical restoration, notably due to unvalidated system dependencies (51%) or a lack of confidence in the cleanliness of restored data (49%).
The report presents an alternative approach, that of the Minimum Viable Company (MVC), i.e., the most reduced version of the company capable of continuing to serve its customers and maintain its critical operations while recovery continues. Only 23% of French participants have formally documented and tested an MVC. Among them, 75% state that it directly determined what was prioritized and restored first during a cyberattack.
Olivier Savornin, Vice President Europe at Cohesity, summarizes the finding: “The problem is not the procedure manual, but the world for which it was written.” He adds that “AI and autonomous agents are creating new compromise paths,” while the expansion of cloud and SaaS increases the number of systems involved in recovery.
AI Deployed Faster Than Its Recovery Plans
While 98% of French respondents report using AI systems, applications, workflows, or machine learning models, only 33% believe their plan comprehensively accounts for attack scenarios targeting these elements. Furthermore, 62% of organizations are not very confident in their ability to verify the integrity of AI models and associated data after an incident, and 61% say they are poorly prepared to restore systems affected by unintended actions of AI agents, copilots, or AI workflows.
Faced with the rapid evolution of frontier AI capabilities, 80% of French respondents believe their current plans would require moderate to significant changes, and only 5% consider them suited to these conditions. According to Olivier Savornin, “the ability to validate their integrity after an incident becomes a prerequisite for trust.”
Methodology”: “the survey was commissioned by Cohesity from Vanson Bourne in July 2026”, involving 3,200 IT and security decision-makers across eleven countries. The French portion is based on 400 participants from organizations with at least 1,000 employees.
