Recovering OT systems after total compromise

When an attack reaches operational technology, the incident stops being an IT problem. Lines halt. Logistics revert to pen and paper. In 2024 a single hit on CDK Global put thousands of dealerships on paper for weeks; manufacturing takes the same shape with higher stakes, and it draws roughly 40% of global ransomware incidents.

What the first 72 hours actually look like

The playbooks say "restore from clean media." The floor says something else. Engineering workstations are encrypted. The historian is encrypted. The domain controller that authenticated everything is gone, and with it the credentials your recovery infrastructure trusted. Teams discover that the copies meant for recovery lived on the same network as everything else, reachable, and were encrypted first. Attackers go for the recovery estate deliberately; industry reporting puts attempts to compromise it in the mid-nineties of percent of cases.

So the real sequence begins: verify what survived, if anything. Rebuild identity from scratch. Reimage machines one by one. Reconstruct configurations from memory and PDFs. Published incident reporting puts the average restoration period around 24 days. For a plant, each of those days has a number attached.

What shortens weeks to hours

One thing: a copy the attack could not reach, held apart from the network physically, with the restore simple enough that the people on shift can run it. Not a faster rebuild. A restart point.

That is the difference between a recovery copy and a restart copy. A recovery copy is data you hope survived. A restart copy passes five specific questions about paths, credentials, physics, people, and rehearsal.

Take the Restart Copy Test → · Put your own numbers on the outage →