Ransomware Recovery Isn't a Backup Problem. It's an Identity Problem.
Security Boulevard, Friday, October 16th, 2026
Fenix24 data shows ransomware recovery stalls on Active Directory: 99.2% of victims had no identity recovery plan.
Fenix24's first State of Recoverability report, drawn from more than 500 real ransomware recoveries, found that only four of more than 800 engagements came close to 24-to-48-hour recovery targets, and none reached full operations for weeks.
The bottleneck was identity rather than backups, as 99.2% had no documented plan to recover their identity system and about 20% of the first 48 hours went to establishing one trusted authentication source.
Because attackers who steal the KRBTGT hash can forge Golden Tickets that survive restores and password resets, recovery requires resetting KRBTGT twice.
Boards should demand tested Active Directory recovery plans, not just backups.