Backup vs cyber recovery
Short answer: Backup produces copies. Cyber recovery assumes an attacker has reached production (and perhaps the copies) and requires a rehearsed, operable path to restore a clean point.
Definition
Backup and cyber recovery are confused because both talk about copies. Backup answers errors, deletions and infrastructure failure: you need an earlier point. Cyber recovery answers an incident in which someone has tried to prevent that restore. The question stops being “do we have copies?” and becomes “can we recover a clean state when the attacker has also seen the copies?”.
What backup covers
Backup is the discipline of taking, retaining and being able to restore recovery points. It covers human error, hardware failure, accidental corruption and much of disaster recovery when the site is still trusted.
A well-run backup has a schedule, retention, a target and a procedure. That does not, by itself, prove the copies will survive an attacker with privileges.
What cyber recovery adds
Cyber recovery starts from the possibility of breach. You need to identify a clean point, stop copies being altered or deleted, and restore services (often identity and data together) with a plan someone has actually run.
Immutability, isolation where it applies, validation of copies and a recovery order are part of that path. They are conditions for backup to remain useful when the incident is deliberate.
Operational recovery
The practical difference is proof: has it been restored, is the timing known, is it clear what will not be restored first? A plan that exists only in a document is an unknown.
Disaster recovery covers site, premises and infrastructure. Cyber recovery covers the case where the adversary is inside. They may share copies; they do not share the assumption.
In the Azuba model
Data Protection & Resilience keeps backup, immutability, disaster recovery and cyber recovery as distinct capabilities. The weight of each depends on the estate.
In Data Protection & Resilience, Rubrik covers immutable copies and recovery when an attacker has reached production. Keepit covers copies of SaaS outside the provider.
Continue
If I have backup, do I already have cyber recovery?
No. Backup produces copies. Cyber recovery requires those copies to remain restorable when an attacker has tried to prevent recovery, and that the procedure has been rehearsed.
Does immutability equal cyber recovery?
No. Immutability protects the recovery point. Cyber recovery also includes isolation where it applies, validation, restore order and operational rehearsal.