.webp)
The breach is over.
The systems are back online. Business is operating again. The incident response team has wrapped up. The cyber insurance claim is underway. Everyone wants to move on.
That's exactly when I tell clients to slow down.
After being involved in enough incident response engagements, I've learned that the recovery phase is where organizations either become significantly stronger or quietly set themselves up for the next incident.
The attack is over, but the work isn't.
A good recovery isn't measured by how quickly systems came back online. It's measured by what changes because of it.
So, what does good actually look like?
The first priority isn't buying new security tools or launching a dozen projects. It's understanding exactly what happened.
How did the attacker gain access? How long were they in the environment? What controls worked and which ones failed? More importantly — which assumptions turned out to be wrong?
Almost every engagement uncovers the same conversations.
"We thought MFA was enabled everywhere." "We thought backups had been tested." "We thought our MSP was monitoring that." "We thought someone owned that process."
Recovery starts by replacing assumptions with facts.
One mistake I see organizations make is treating every finding as an isolated task — reset passwords, deploy MFA, patch systems, review firewall rules. Those are all important, but working through them one by one doesn't create a stronger security program.
Instead, step back and build a roadmap. Prioritize improvements over the next 30, 60, 90, and 180 days. Identify what reduces the most risk, who owns each initiative, and how progress will be measured.
A breach should leave you with a plan, not just a checklist.
If there is one area that consistently deserves immediate attention after a breach, it's identity. Review privileged accounts, remove stale accounts, rotate passwords and credentials, expand multi-factor authentication, review conditional access policies, and validate service accounts. Most attackers don't need sophisticated exploits if they can simply use valid credentials. Strengthening identity is one of the highest-value investments an organization can make in the post-breach window.
Every company tells me they have backups. Far fewer can tell me how long it actually takes to recover their business. Recovery isn't about whether backups completed successfully overnight — it's about whether critical systems can be restored, in the correct order, within an acceptable timeframe. Test them. Document your recovery objectives. Run through realistic scenarios. Hope is not a recovery strategy.
Incidents have a way of exposing gaps in shared responsibility. Internal teams assume the MSP is monitoring something. The MSP assumes the client owns it. A cloud provider secures the platform while the customer assumes the application layer is covered too. After a breach, review every vendor relationship — understand who owns what, review privileged access, validate monitoring responsibilities, and update contracts where the lines were unclear. If you worked with an incident response partner during the breach, that relationship is worth formalizing. Knowing who to call before the next event is part of rebuilding smarter. Good security extends well beyond your own employees.
The strongest recoveries don't end with technical improvements. They end with better governance. Leadership should understand the organization's highest risks, know where investments are being made, review progress regularly, and assign clear ownership for security initiatives. Security shouldn't disappear until the next annual assessment — it should become part of how the business operates.
One of the best indicators of future success is whether an organization actually practices what it has learned. Update the incident response plan, run a tabletop exercise, test your communications, validate executive decision-making, and practice recovery. Every exercise should answer one question: "What have we improved since the last incident?" If the answer is "nothing," the organization hasn't really recovered.
No organization wants to experience a breach. They're disruptive, expensive, and exhausting.
But they also provide something that's difficult to get any other way: complete visibility into where your security program actually broke down.
The organizations that recover the strongest don't waste that opportunity. They don't rebuild the same environment they had before. They build a better one.
That's what a real data breach recovery plan should accomplish — not simply restoring operations, but driving the post-breach security improvements that only become visible once you've gone through it. The lessons learned after a breach are the most honest assessment of your security program you'll ever get.
I've seen organizations come out of an incident with stronger governance, better visibility, clearer ownership, and a security program that was significantly more mature than the one they had before.
That's what good recovery looks like.
If your organization experienced a breach tomorrow, would your recovery plan simply restore your systems, or would it improve your business?
This is the final post in our three-part Breach Series. Part one covered the warning signs that exist before an incident. Part two walked through what the first 24 hours actually look like. This post covers what comes after — and why that phase matters most. If you're unsure how your organization would respond or recover, let's have a conversation before you're forced to find out the hard way.
.webp)
Most cyberattacks do not start with elite hackers or advanced exploits. They start with simple gaps. A stolen password. A phishing email. A forgotten backup. For many organizations, the biggest threats are ransomware, email compromise, and credential theft. The damage can be significant.
Security is not one size fits all. A 10-person startup with an MVP and a short runway should not be investing like a 5,000-person global SaaS company preparing for IPO. But too often, companies either underinvest early or throw money at tools without a plan later.
Cyber insurance used to be a checkbox. Today, it is a battleground. Carriers have tightened their requirements, premiums are on the rise, and coverage exclusions are more aggressive than ever. Many companies find themselves unprepared, with no clear roadmap on how to qualify or reduce their costs.
Is your organization prepared to handle cyber threats? From ransomware readiness assessments to virtual CISO leadership, TechCompass offers comprehensive solutions to secure your digital assets.
