When the Screens Go Dark: The Backup Conversation You Need Before Friday at 4:47pm
The Sekhmet Scribe | Team Sekhmet
IT ALWAYS HAPPENS ON A FRIDAY
Or a bank holiday. Or during a leadership offsite in a village with questionable signal.
A ransomware payload detonates. Screens lock. A demand appears. And suddenly every conversation about backups, disaster recovery and incident response that was quietly deprioritised for the better part of a year becomes extremely, urgently relevant.
This edition of The Sekhmet Scribe is about recovery…… what it actually takes, why most organisations are less ready than they believe and what to do about it before the incident writes that lesson for you.
Protect • Empower • Evolve
WHAT’S HOT 🔥
Ransomware Has Become an Industry
This is not a figure of speech. Ransomware-as-a-Service ecosystems now operate with affiliate programmes, customer support desks for victim negotiations and product ratings on dark web forums.
The barrier to launching an attack has collapsed. You do not need technical sophistication. You need a target and a subscription.
UK organisations remain disproportionately attractive: strong insurance markets, regulatory exposure and a cultural tendency to resolve quietly rather than disclose loudly. Attackers are well aware.
86% of ransomware is deployed outside business hours. Weekends. Bank holidays. December.
This is not opportunism. It is operational planning. They know when the fort is unmanned.
WHAT’S HOT 🔥
You Have Backups. But Do You Have Recovery?
Most organisations have backups. What most organisations do not have is a tested, verified, recovery-ready strategy.
The gaps are predictable:
Backups stored on the same network as production, ransomware encrypts those too, without hesitation. Backups that have never been restored under real conditions, until you have tested the restore, you do not have a backup. You have an assumption. And assumptions do not survive ransomware.
RTOs written on paper but never stress-tested, every minute of downtime has a cost. Do you know yours with confidence?
A backup is only as valuable as the recovery plan attached to it. The two are not the same thing.
WHAT’S HOT 🔥
Cyber Insurance Is Tightening. Considerably.
Insurers have absorbed several years of costly ransomware claims and the market has responded accordingly. Premiums are rising. Exclusions are expanding. Underwriters are conducting genuine technical assessments.
Organisations that cannot demonstrate MFA, endpoint detection, patch management and tested backup procedures are finding coverage difficult to obtain…… and expensive when they do.
Insurance is no longer a safety net. It is a governance signal. If you cannot get covered affordably, your security posture has a measurable problem.
WHAT’S NOT ❄️
Paying ransoms as a default response. Treating insurance as a substitute for resilience. Disaster recovery documentation stored on a server that is now encrypted. Testing backups once a year, optimistically, if at all.
The organisations that recover fastest are the ones that practised before the incident…… not the ones that improvised during it.
THE SEKHMET STANCE
Recovery is not a technical function. It is a business function.
At Sekhmet, we build backup and disaster recovery strategies around your actual operations: your critical systems, your RTOs, your regulatory obligations and the realities of how your team actually works under pressure. Then we test it. Properly.
Because when the screens lock at 4:47 on a Friday, you want a plan that has already been run through its paces…….. not one you are reading for the first time.
The lioness does not check the den when the storm arrives. She checks it long before.
Know your recovery plan. Test it. Trust it.
Protect • Empower • Evolve
Team Sekhmet