What:A global survey of 1,000 senior executives across 20 industries finds that 81% expect critical systems to be restored within 10 days of a cyberattack, while real-world cases average three to six months.

Why it is important: Only 43% of executives say cyber resilience is governed as a shared business outcome and only 35% regularly run real recovery exercises, so most organizations have not tested whether they can operate when systems fail.

A global survey of 1,000 senior executives across 20 industries in 13 countries finds that 73% still believe predict-and-control security is sufficient, and 81% expect critical systems to be restored within 10 days of a cyberattack. Analysis of real-world cases puts the average at three to six months, and business interruption accounts for more than half of all cyber claims. Attacks rose 89% year over year in 2025, according to CrowdStrike, and breakout time fell from 62 minutes in 2023 to 29.

The Accenture authors argue that the fastest recoverers define a "minimum viable enterprise": the smallest set of decisions, applications and processes needed during extreme events. They set out five steps: define the essential operating core by asking what must not stop if all applications were down for 72 hours; predefine decision rights and recovery sequencing; map hidden dependencies; build a clean recovery environment on validated, immutable backups, with 24 to 72 hours as the benchmark for vital functions; and test under real scenarios, which only 35% of organizations do regularly. A U.S. airline with predefined essential operations was largely operational the day after the 2024 global IT outage.

IADS Notes: The article's finding that shared dependencies can halt operations has several recent retail precedents. Muji suspended online sales in Japan after a ransomware attack on its logistics partner Askul (Bleeping Computer, October 2025), and a cyberattack on logistics partner CEVA exposed De Bijenkorf customer data and caused significant delays to orders, returns and refunds (nu.nl, September 2026). RH-ISAC attributes such exposure to vendor risk programmes that stop at direct suppliers, leaving fourth-party dependencies unmonitored, and recommends mapping critical dependencies and rehearsing the multi-day loss of a critical supplier (RH-ISAC, August 2026). The leadership cost of prolonged disruption is visible at Co-op, whose chief executive is stepping down as the costs and operational disruption of a major cyberattack mounted (Financial Times, March 2026), while Harvard Business Review has argued that traditional risk management is proving inadequate and that integrated, cross-functional resilience leadership, such as a Chief Resilience Officer, is needed (Harvard Business Review, May 2026).

Your company needs a plan for the first 72 hours after a cyberattack