Research reportsCohesity

Cohesity survey: rehearse business continuity as well as system recovery

In a survey published by Cohesity on 16 September, 78% of respondents focused on restoring systems, while only 22% had documented and tested the minimum operations needed to keep core business running. The sample comprises large organisations and cannot be treated as representative of Hong Kong SMEs, but it highlights the need to link exercises to actual work.

Anti-Ransomware · Compiled with SI agent assistanceOriginal advisory published:Checked 2026.10.25
A small business team discussing downtime response around a table, with printed workflows and handwritten notes in daylight. (Original AI illustration, not a photograph of the event)
Illustration · Source ↗ · About this image ↗

Source Facts

Cohesity published its fifth Global Cyber Resilience Report on 16 September. Its commissioned Vanson Bourne survey found that 78% of respondents focused on restoring systems; 37% had formally documented the minimum viable company (MVC) needed to sustain core operations, and only 22% had both documented and tested it.

The survey was conducted in July 2026 among 3,200 IT and security decision-makers at organisations with at least 1,000 employees in 12 countries. Results are self-reported by a specific sample and do not represent all businesses or Hong Kong SMEs. System availability, identity access and business operability also require separate validation.

Next Steps for Businesses / Editorial Observations

For the next exercise, choose a real task such as invoicing or delivering a document. Test every step from employee login to completion, rather than merely checking that a server starts.

Next steps you can take

  • Choose one critical task that must continue during downtime and list its system, identity and personnel dependencies.
  • Have business staff complete real workflows during recovery exercises, recording why work could not continue.

Original sources

Cohesity Research Finds Most Cyber Recovery Plans Are Built for the Wrong Outcome

Sources checked: 2026-10-25 · Compiled with SI agent assistance; not individually reviewed by a human.

This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.

Back to news ←

KEEP READING

Recommended reading

Related reports and practical guides selected for this article's topic.

Original synthetic illustration of incident response colleagues checking an event timeline and system accessIllustrationResearch reports · 2026.10.23

SOCRadar examines SI agent-assisted extortion: human approval remains part of the intrusion process

SOCRadar Threat Research UnitOriginal synthetic illustration of grain warehouse staff maintaining logistics operations with paper delivery notesIllustrationResearch reports · 2026.10.22

ESET reviews data wiping at a Ukrainian logistics company: backdoor communications were hidden in a mesh network

ESET ResearchOriginal illustration of a technician inspecting backup drives and separated cables in a standalone cabinet to demonstrate backup isolationIllustrationThreat Advisories · 2026.10.20

CISA and partner agencies issue a SafePay ransomware advisory, urging isolated backups and restrictions on administration tools

CISA / FBI