Ransomware: no one recovers

Article by Nacata Security, 16/09/2026

Do you have a plan to survive a ransomware attack? Almost no one truly does.

A damning report confirms that recovery plans fail almost every time.

Fenix24 analyzed more than 500 real-world recoveries and published its findings on September 15. This is not a theoretical warning — it is a record of what happens when the attack actually arrives.

Companies had documentation, procedures, and backups in place. When the attacker truly got in, that entire scaffolding collapsed within hours.

The plan existed, but it did not survive first contact.

Of the more than 800 clients assessed, only four came close to their recovery objective within 24 to 48 hours — and only for partial operations. None restored full capacity until weeks later. 99.2% arrived with no documented plan to recover their identity systems, and the few plans that did exist collapsed the moment the attacker moved through the network.

The first system to fall was always the same one.

Active Directory — the directory that manages who can access what within a company — was the first major system compromised in virtually every case. 94% of organizations had their backups connected to that same directory the attacker already controlled. Recovering the backups required accessing the compromised system. A circle with no way out.

20% of the first day was spent just cleaning up a single account.

Simply to have a minimally reliable authentication source, companies consumed one-fifth of those critical first 48 hours. Reaching a minimum viable infrastructure required at least 72 additional hours. Meanwhile, 95% of clients had no multi-factor authentication controls on their critical infrastructure consoles.

Backups did not save anyone either.

In 38% of cases where backups survived the attack, they still could not sustain the recovery. Some were too old, others were corrupted before the ransomware arrived, and others simply took longer to restore than rebuilding everything from scratch.

The company’s map did not exist.

None of the clients had a complete picture of every application they used or what each one depended on. That map — essential for deciding what to recover first — lived in databases that went down along with everything else. Companies had to draw it by hand, in the middle of chaos, while deciding which part of the business to bring back first.

Physical storage and the network also failed unexpectedly.

In 82% of cases, storage ran out of space, forcing a choice between saving restored data or preserving forensic evidence. In 38% of incidents, the network lacked the capacity to move data at the pace a real recovery demands.

Simulating without truly testing is the same as having no plan at all.

Fenix24 states it plainly: a simulation that does not walk through the complete restoration path against current recovery objectives is worthless. A plan that has never been genuinely executed is nothing but paper when ransomware arrives.

The recommendation is concrete and demands real work.

Identify the most critical service, map everything that depends on it — including third parties — and execute the restoration from start to finish while measuring whether recovery time objectives are met. Not as a theoretical exercise, but as a real test against current systems.

Without that test, the plan does not exist.

Fenix24’s data tells the story of companies that never verified whether their safety net could hold the real weight when it mattered most.

Do you know how long it would take your company to get back up and running if ransomware hit tomorrow?

Security is not improvised, it is audited. At Nacata Security we detect vulnerabilities and protect your company, because a single flaw can cost you everything you have built.

Related articles

Nacata Security, reach out to us anytime