This is the solution to the Empalis New Year's Eve puzzle 2025/26
We would like to sincerely thank everyone for their enthusiastic participation in our cyber quiz and once again congratulate the winners. And here is the solution:
The quiz question: Cyber Recovery Time
At the heart of the quiz was the question: "What is the average cyber recovery time?"
– and: Do you know the recovery time in your own company?
What we were looking for in the quiz was not a single, concrete number – but rather the understanding that the assessment of cyber recovery time (CRT) is not a general value, but always only applies to a specific company.
Definition of Cyber Recovery Time (CRT)
Cyber recovery time is the key performance indicator for the time a company needs until it is operational again in a crisis – i.e., until it can resume productive work at a defined operational level. It describes the period from a cyber incident until a company is able to resume operations at a predefined level (often also called "Minimum Valuable Company"). It is therefore also a component of the MTTR (Mean Time To Recover). In addition to the Recovery Time Objective (RTO), the Cyber Recovery Time includes the validation of backup data and the removal of any malware.
For industry-specific purposes, the average duration measured in the "DACH Deck – Global Security Research Report 2024" provides guidance. According to this report, the average Cyber Recovery Time in the DACH region was empirically 8.6 months in 2025.
The Answer: Measuring Cyber Recovery Time
The answer, therefore, lies in making a sound estimate or measurement of your own cyber recovery time and placing it in the context of your company's resilience. There is no single "correct" number.
Possible answers included those that addressed this understanding of average cyber recovery time or placed it in the context that it can vary significantly depending on the organization and the maturity level of its cyber resilience, and therefore must be measured specifically. It is crucial for every company to recognize that its own recovery time is a key indicator of modern cyber resilience.
Why Cyber Recovery Time Can Vary
Depending on the company and its IT environment, cyber recovery time varies considerably, as illustrated by some of the following reasons:
Maturity of Restore Capabilities
The more robust and thoroughly tested recovery processes are (e.g., through versioning, immutability, etc.), the faster recovery can begin and be validated – thus shortening cyber recovery time.
Organizational Processes and Responsibilities
Emergency plans and defined business continuity management processes allow for a faster response to an incident, which impacts recovery time.
Complexity and Scope of the IT Landscape
Larger or heterogeneous IT environments typically require the coordination of multiple or even numerous systems and components – which can also extend cyber recovery time.
Type of Cyberattack and Data Integrity
A cyber incident can not only cripple systems but also compromise backup data. If these issues first need to be resolved and validated, the cyber recovery time will be longer than simply calculating the Recovery Time Objective (RTO).
Further factors influencing cyber recovery time
External factors such as external service providers, compliance factors like reporting obligations, and legal requirements can impact the recovery process.
For these reasons, cyber recovery time is not a fixed metric, but rather a variable that depends on the organization and the specific situation.
At a glance: Technical, organizational, and human-process factors influencing cyber recovery time
Versioned immutable backups with air-gap reduce the risk of failure and accelerate recovery.
Segmented networks and zero trust designs limit the damage from an attack.
Incident response playbooks are elaborate, regularly tested emergency plans that reduce uncertainty in an emergency and accelerate processes.
Cyber Recovery Time definitions and BCM analyses should be evaluated in a coordinated manner so that all stakeholders know the priorities and the desired post-incident state is clearly defined
The better informed employees are about early warning signs and escalation channels, the sooner recovery can be activated.
Regular recovery tests uncover vulnerabilities and improve actual recovery processes.
Additionally, there are other external to consider such as regulatory requirements, .e.g NIS2 and DORA may necessitate formal steps that affect the timeline.
Achieve the Best Cyber Recovery Time in 6 Steps
A systematic approach based on proven best practices is recommended:
- Define and monitor metrics: Implement KPIs such as Mean Time to Detect (MTTD), Mean Time to Restore (MTTR), and current Cyber Recovery Time.
- Implement regular backups: Immutable backups, versioning, and air-gapped storage prevent backups from being compromised.
- Test recovery processes: Simulated ransomware scenarios and regular recovery tests validate processes and identify vulnerabilities.
- Review, test, or implement emergency plans: Documented, role-based processes accelerate decision-making in an emergency.
- Strategically build cyber-resilient architecture approaches: Segmentation, zero-trust approaches, and cloud-based, more resilient structures minimize attack surfaces and recovery effort.
- Continuously optimize: After every test or incident, an analysis should be conducted to adjust the strategy and optimize based on lessons learned.
CONCLUSION: Warning Sign: Cyber Recovery Time
We've known for a long time that the question is no longer whether an attack will occur, but whether companies are cyber-resilient enough to regain operational capability as quickly as possible after an attack.
The fact that the average time it takes for a company to be fully operational again after a cyberattack was measured at 8.6 months in the DACH region last year should therefore be interpreted as a warning signal. As long as companies don't know their own Cyber Recovery Time (CRT), meaning they can't measure it and thus can't proactively shorten it, they are potentially more vulnerable to cyber attackers than others in their industry. This is a risk that can cost a company its very existence.
Therefore, it is recommended to include Cyber Recovery Time as a KPI at the management level. By increasing and improving your measures, you gain valuable time in an emergency to maintain your ability to act - and the trust of your partners and customers.
