Megatrend · Cybersecurity & Digital Trust
Assume you'll get hacked — the real question is how fast you get back up
Most IT security talk is about "keeping the bad guys out." But the statistics are clear: sooner or later, someone gets in. So when that day comes — when attackers encrypt every file in the company and demand a ransom — how do you bring your systems back in hours, not weeks? This is the story of cyber resilience — accepting that you'll be hit, and preparing copies of your data that attackers can't encrypt and can't delete (immutable / air-gapped) so you can recover. Pair that with a "clean room" way to restore that doesn't drag the virus back in. The point isn't just defense — it's recovery — because the real damage isn't the ransom, it's the days the business stops running.
01What it is
Picture a Monday morning. An employee opens their computer and sees a black screen: "All your files have been encrypted. Pay Bitcoin within 72 hours or we delete them." The sales system is down, inventory can't be checked, payroll can't run, the hospital can't open patient records. This is ransomware (extortion malware) — and it's no longer a question of "if," it's a question of "when."
Most of the security industry pours money into keeping intruders out — firewalls, email scanning, device scans. But the painful truth is that no matter how high the wall, eventually someone clicks the wrong link, or a hole goes unpatched. This node was born from accepting that truth and asking a new question: "If we're going to get hit anyway, how fast can we get back up?" That's the idea behind cyber resilience — the ability to recover, not just defend.
It has three core parts: (1) copies of data attackers can't destroy — unchangeable and undeletable (immutable), or cut off from the network (air-gapped); (2) checking that the copy is genuinely clean, with no virus hiding in it; and (3) an orderly recovery that gets the business running again in measurable time. On the megatrend map, it's a branch under Data Security & Cyber Resilience within the larger trend Cybersecurity & Digital Trust, with a sibling right beside it: Data Security Posture & DLP, which focuses on stopping data from leaking out, while this node focuses on getting data back after an attack.
Immutable backup = a copy that, once written, can't be changed or deleted until its retention period ends — not even by the highest-privilege admin. That blocks an attacker who steals admin credentials to wipe the copies · Air-gapped = a copy with its "bridge" cut from the main network, so malware can't reach it · RTO (Recovery Time Objective) = the target for how many hours it takes to finish restoring systems · RPO (Recovery Point Objective) = how many minutes/hours of data you can afford to lose (depending on how often you back up)
02Why it matters — the cost is in the "days the business stops"
People assume the cost of ransomware is the "ransom" — but that's actually the smallest part. The mid-2025 ransom is around $1 million (down by half from $2 million in 2024, because organizations can now recover on their own instead of paying). But the total cost of an average ransom incident reaches $5.08 million, per IBM's 2025 report — the rest is the days the business is down, system recovery costs, legal fees and fines, and lost customers. IBM says downtime costs more than double the ransom itself.
Why does this matter at the level of the whole economy? Because ransomware has become an industry — there's ransomware-as-a-service (RaaS) that rents out attack tools and splits the ransom on commission, so even people with no technical skill can pull it off. In 2024, 55 new RaaS families appeared (up 67%), and double extortion (encrypting plus threatening to leak the data publicly) showed up in 87.6% of claims. Once attacks are packaged as a "business," being able to recover becomes a cost no organization can dodge — and that's the demand driving this market up.
The result is money flowing steadily into the data resiliency market (security-grade data recovery) — from about $22.8 billion in 2025 to a projected ~$96.6 billion by 2035, or about ~16.9% a year. Because backup is no longer "a necessary IT expense" — it's become a security investment that boards and insurers demand.
03How it works (from backup to recovery)
People tend to think "I've got a backup, that's enough" — but today's attackers are smarter than that. 93% of attacks aim to "delete the backup first," then encrypt the main systems, because with no copy to restore from, the victim has to pay. And in cases where the backup attack succeeds, 75% leave the victim unable to recover at all. So cyber resilience isn't just "having a backup" — it's a four-step process designed specifically to fight off attackers.
The trickiest step is step 3 — the "clean room". The classic problem with ransomware recovery is that if you restore data into the old system that's still infected, the virus re-encrypts it instantly. So clean recovery builds a fresh, clean environment, fully separated from the old one, then carefully moves scanned data back in — like doing surgery in a sterile operating room, not in a room that just had an outbreak.
04Where it sits in the security world
This node is the "last line of defense" — the gate that kicks in when every layer before it has already failed. So it doesn't stand alone; it's inseparably interwoven with the other branches of the ecosystem.
- Paired with EDR/XDR (endpoints): EDR detects and stops attacks early, while this node is the backup plan when EDR can't stop it in time — an EDR alert that "something's wrong" is often what triggers the recovery team to start. The two work as one team
- A sibling to Data Security Posture & DLP: DLP focuses on stopping data from leaking out (no theft), while this node focuses on getting data back after it's encrypted (no stoppage) — two sides of the same "data security" coin, often sold bundled into one platform
- Opens the door for Cloud & Digital Infrastructure: the more an organization moves critical work to the cloud, the bigger and more complex the data it has to protect and restore — so new-generation players build SaaS recovery services that live on the cloud from the start
- Accelerated and challenged by AI: the recovery side uses AI to spot anomalies in copies and speed up prioritizing the restore, while the attack side uses AI to find holes and encrypt faster — a chase that drives demand on both sides
05Where it stands now
This field is in the middle of a big shift — from "ordinary backup" (backing up in case a hard drive fails) to "cyber resilience" (backing up to fight attackers). The one riding this wave most clearly is Rubrik, which has built itself into a pure-play on exactly this, went public in 2024, and pushed Subscription ARR past $1 billion, growing ~38%, with over 90% of revenue from subscriptions — a sign that the market will pay for "peace of mind that you can recover."
But Rubrik isn't running alone. This game has three poles: the transformed incumbents, led by Cohesity, which merged with Veritas in late 2024 to become No. 1 by market share (~$2 billion in combined revenue), passing Veeam (No. 2 by share, private) · the public-market rivals like Commvault, accelerating SaaS (Metallic) until SaaS ARR grew over 60% · and the hardware giants like Dell (PowerProtect), IBM, and Pure Storage (its SafeMode feature makes immutable copies at the hardware level), wielding their large-enterprise customer bases as a weapon.
06The road ahead
The first direction is AI accelerating recovery. The hardest part of ransomware recovery is "which point do we restore to?" — restore too far back and you lose data; restore too close and you may drag back a virus that was hiding quietly. AI is being used to automatically find the "latest clean point," prioritize which systems to restore first, and cut RTO from days to hours — this is the real battleground of the next round.
The second direction is cyber insurance becoming the driving force. When insurers start losing money on ransomware claims, they begin to require customers to have immutable backups and recovery drills — or they won't cover them, or they charge much higher premiums. Today 21% of policies exclude ransomware outright, and about three-quarters raised premiums at their latest renewal. It turns out the "insurer" is cyber resilience's best salesperson.
The third direction is merging with the security side. The line between a "backup company" and a "security company" is fading — Rubrik is moving into data security posture, and security players are moving into recovery. Customers want one platform that detects, defends, and recovers. So the wave of M&A in this field won't end easily.
07Challenges & risks
The first risk is the backup itself becoming the target. What should be the last line of defense is the very thing attackers go after first — 89% of attacked organizations had their backups hit, and on average 34% of the copy repository was altered or deleted. So an organization that thinks "we have a backup, we're safe" but whose backup isn't truly immutable may find it has nothing to restore on the day it counts.
The second risk is the gap between the marketing pitch and the real recovery time. Vendors love to talk about RTO in "minutes," but in real life 76% of organizations take over 100 days to fully recover, because restoring an entire tangled company is far more complex than a demo. Organizations that have never drilled a real recovery (the "0" in the 3-2-1-1-0 rule) tend to discover this truth at the worst possible moment.
The third risk is fierce competition and reliance on trust. This market is crowded with transformed incumbents (Cohesity/Veritas, Dell, IBM), fast-growing pure-plays (Rubrik), and large private players (Veeam). M&A is frequent, and those who can't keep up risk being squeezed out. And because this product is the "last line of defense," trust is everything — a single vulnerability or failed recovery can damage a reputation far more deeply than for an ordinary product.
In short: this node is about accepting a truth the security industry doesn't say loudly — that every kind of wall eventually breaks. The real victory isn't just keeping attackers out, but standing back up quickly on the day they get in. And in an economy where everything runs on data, "speed of recovery" is becoming an asset worth no less than the data itself.