Cybersecurity Awareness Month: Test Your Recovery, Not Just Your Defenses

October is Cybersecurity Awareness Month, and most of the attention goes where it should: phishing training, multifactor authentication, patching. Those keep attackers out. But no defense is perfect, and the organizations that come through an attack best are the ones that have already practiced getting back up.

This October, spend part of the month proving you can recover. Here are four tests worth running.

1. Restore something that matters, end to end

Not a single file: a full application, with its database and servers, restored somewhere it can actually run. Time it. That number is your real recovery time, and it's often very different from the one in the plan.

2. Recover identity from a known-clean point

Pick a recent backup of Active Directory and Entra ID and restore a deleted user, group or policy without rolling back anything else. If you have a lab, rehearse the first steps of a forest recovery there. Until identity works, nothing else does.

3. Check that one copy is out of reach

Confirm that at least one copy is immutable or air-gapped, and that the credentials you'd use to delete production can't delete it. If you're not sure, assume they can.

4. Walk through the plan with the people in it

Get the recovery lead, the system owners and the backup contacts in a room, and walk through the order systems come back. Check the phone numbers are current and the plan names people who still work there. Write down what was missing.

Make it a habit, not an event

A test once a year finds problems; regular testing keeps them from coming back. Recovery Co-Pilot (RECO) makes that ongoing: KELYN assesses your readiness, tests restores with your team, scans backups for threats offline, and supports your incident response plan. A biannual KELYN Score review measures the readiness of five areas of your infrastructure, with both quantitative metrics and qualitative insights.

Start with a baseline

The free Cyber Readiness Scorecard gives you a starting point in a few minutes, and the Cyber Recovery Readiness Workbook is a printable checklist and scorecard to fill in with your team.