GUEST OPINION: Businesses across Australia and New Zealand expect to recover from cyber breaches within days, but new research shows the reality is far more severe, with average recovery times still stretching to nearly a month.
A new report commissioned by Commvault found a widening disconnect between executive expectations and operational recovery capabilities, increasing pressure on organisations during ransomware incidents and, in some cases, pushing them towards ransom payments.
The latest State of Data Resilience: Australia & New Zealand study found that 30 per cent of Australian executives and 35 per cent of New Zealand executives expect organisations to resume operations within one day following a cyberattack.
More than 80 per cent expect operations to be restored within five days.
However, the average time required to recover to a minimal operational level remains 28 days across both countries, despite improvements from 42 days recorded in 2023.
Researchers warned that the pressure to restore services quickly is contributing to risky decision-making during ransomware incidents.
According to the study, 44 per cent of organisations across ANZ and Asia reported being targeted by ransomware during the past 12 months.
Among those attacked, 30 per cent of Australian organisations and 34 per cent of New Zealand organisations admitted paying ransom demands.
The outcomes were often unsuccessful.
Nearly half of Australian organisations that paid ransoms said the payment either failed to result in data being released or led to repeat attacks and additional ransom demands. In New Zealand, 36 per cent reported similar outcomes.
The report found that concerns around backup integrity, reputational damage, legal risks and recovery speed were among the leading factors influencing whether organisations paid cybercriminals.
Researchers argued that organisations should instead focus on defining a “Minimum Viable Company” (MVC) strategy — identifying the minimum operational capabilities required to continue serving customers during a breach.
The data showed organisations with clearly defined MVC requirements linked to technology recovery capabilities were significantly more likely to maintain operations and recover faster during cyber incidents.
While 60 per cent of Australian organisations and 63 per cent of New Zealand organisations have defined MVC requirements for business operations, fewer than half have established equivalent requirements for technology environments.
The report also highlighted growing demand for partners capable of delivering expertise across cyber resilience, AI governance, identity management and multi-cloud infrastructure operations.
Commvault said organisations are increasingly recognising that resilience must become a continuous operational discipline rather than a reactive recovery process.
The company described this emerging model as “ResOps” — an always-on resilience framework integrating security, IT operations and data management to improve recovery readiness, automate response processes and maintain operational survivability during inevitable disruptions.
