By Sean Deuby, Principal Technologist, Semperis
Another World Backup Day just passed by, and it’s an important reminder every year of the increasing likelihood that your organization will be the next cyberattack target. Over 275 million individuals were affected by data compromise in the US alone in 2025, and a wide range of companies have already been breached this year. Whether you’re a large auto manufacturer, a local government agency or a regional broadband provider, all organizations must assume that they could soon be a victim.
So, what does the current risk landscape look like, and what do security and IT teams need to prioritize to ensure resilience?
Today’s threat reality
Cyber threats are continuously evolving and becoming more frequent and sophisticated, especially through the growing use of AI. It’s estimated AI-powered cyberattacks surged 72% from 2024 to 2025, with nearly 90% of global organizations reporting an incident.
Identity systems have also become incredibly difficult to secure. Modern companies consist of a rapidly growing number of human, non-human and agentic identities. This increased scale and fragmentation is why Microsoft’s latest Secure Access report labeled identity security as the new pressure point, as the resulting blind spots open the door for attackers to move laterally across organizations without being detected.
In this threat landscape, security teams can no longer be asking themselves how to avoid being breached, but instead how they can minimize the damage once they’re targeted.
Cyber resilience in 2026
The Semperis team recently surveyed 1,000 organizations globally about their readiness to respond to cyber threats, and while most said they have a cyber crisis response plan in place, 71% still experienced at least one cyber incident that stopped critical business functions. Where could they be going wrong?
While backups remain essential, businesses need to think more broadly about recovery, resilience and what it takes to restore operations with confidence after an attack. Backups matter not only because they preserve data, but because they enable recovery. If you cannot recover with it, then a backup does not help you.
Organizations need to create a clean recovery environment and restore critical systems quickly, securely and outside the control of threat actors. That means broadening recovery strategies to account for the underlying infrastructure that enables the business to function, particularly identity systems such as Active Directory, Entra ID, Okta and Ping Identity, which are central to access, control and trust across the organization. You cannot assume that threat actors will leave any of your critical systems alone, and if your identity environment isn’t secure, nothing in your organization is.
As part of this, it’s crucial to understand that recovery planning should not just focus on what can be restored, but how effectively the organization can respond when critical systems are unavailable. Identity recovery is becoming an increasingly important part of crisis response, as unlike other workloads, restoring identity system operations is only part of the recovery process. Removing persistence, or back doors, is a critical step to restoring trust in the identity system. Without this return to trustworthiness, organizations may be compromised again within days or even hours. When identity is lost or cannot be verified, the resulting disruption not only affects technical recovery but also complicates communications, coordination and decision-making even further.
ITDR must take the lead
This brings me to my final point: organizations must prioritize comprehensive identity threat detection and response (ITDR) that ensures prevention, detection, response, and recovery of multi-cloud and hybrid identity environments. By taking this more integrated approach that factors in identity system compromise as part of their recovery plans, organizations will strengthen their resilience, reduce disruption and recover more effectively in the event of an attack.
Don’t wait until World Backup Day comes around again to revisit your recovery strategy. Attackers won’t be waiting either.
##
ABOUT THE AUTHOR
Sean Deuby, Principal Technologist at Semperis
Sean Deuby brings over 30 years’ experience in Enterprise IT and Hybrid Identity to his role as Principal Technologist at Semperis. An original architect and technical leader of Intel’s Active Directory, Texas Instrument’s Windows NT network, and 15-time MVP alumnus, Sean has been involved with Microsoft identity technology since its inception. His experience as an identity strategy consultant for many Fortune 500 companies gives him a broad perspective on the challenges of today’s identity-centered security. Sean is also an industry journalism veteran; as former technical director for Windows IT Pro, he has published over 400 articles on Active Directory, Azure Active Directory (now Entra ID) and related security and Windows Server.
