Disaster recovery and backup efforts have long focused on restoring data and systems. Yet, data backup alone doesn't answer how to recover identity -- a service that's increasingly under attack.
Sophos' State of Identity Security 2026 report, for example, found that 71% of organizations suffered at least one identity-related security breach in the past year. Another Sophos report found that 67% of incidents were rooted in identity-related attacks, and that attackers took just over three hours to reach the Active Directory (AD) server.
Ransomware can further complicate recovery when attackers compromise the identity infrastructure the organization relies on to authenticate users and restore other systems. According to a 2025 ransomware risk report by Semperis, 83% of ransomware attacks compromised an organization's identity infrastructure.
Restoring identity services is now a separate recovery effort, distinct from rebuilding systems and files. Attackers who exploit identity systems can remain embedded if the recovery process fails to uncover and remove them.
How compromised identity delays restoration
There is at least one simple reason why identity isn't always part of standard recovery: It's difficult to do.
Microsoft's guidance shows how complex this process is. The AD forest recovery guide has 29 steps and spans 149 pages. If you make a mistake, you may have to start again. Traditional backups can make things harder because restoring AD data does not always ensure a clean identity environment. If a backup is made after an attacker has gained access, it could bring back malicious changes along with the legitimate data.
The complexity and time-intensive nature of identity recovery have played out multiple times in a very public way.
When Ascension Health was hit by a ransomware attack in 2024, only a small number of its roughly 25,000 servers were directly compromised. But identity systems have to come back online before anything that depends on them can. After the attack, Ascension restored electronic health record access one market at a time; the process took six weeks. During this disruption, Ascension facilities across several states relied on manual, paper-based procedures.
The difficulty of restoring AD after a major cyberattack is not new. In 2017, Maersk needed nine days to recover AD following the NotPetya attack.
Another challenge is that malware can stay in identity systems even after recovery. Attackers use misconfigured certificate templates to create hidden administrator accounts to evade multifactor authentication controls. They may also plant backdoors at the hypervisor level that survive reboots and normal cleanup. Even if identity systems pass a standard recovery check, attackers can still be present because these techniques are designed to survive exactly these types of checks.
The gap between recovery tools and recovery readiness
Recovery programs often fail to treat identity as a distinct priority. For example, Gartner's IT Resilience Survey of 2026 said that although many organizations have core recovery capabilities, they can't use them effectively because of weak strategy and integration.
A Recovery Point analysis of Gartner's survey found strong adoption of backup automation and isolated recovery environments, but many organizations still lack the identity-specific safeguards, such as immutable storage and clean system images, needed to verify that recovered identity systems are clean.
According to 2025 research from Semperis, 90% of surveyed organizations had adopted an identity threat detection and response strategy, but just 45% had methods to correct identity vulnerabilities once identified.
This need for identity-specific recovery has grown as attackers increasingly target credentials and identity infrastructure to gain access, escalate privileges and impede restoration. Identity has replaced the network boundary as the primary attack surface. As a result, companies are bolstering their identity and access management (IAM) investments; Forrester, for example, projects IAM spending to grow at a 15.3% compound annual rate through 2029, reaching $27.5 billion.
To match the modern needs of identity recovery, take the following actions:
- Secure the identity backup. Confirm that backups exist independently of production identity system credentials. Keep a copy offline or air-gapped in a location where an attacker with stolen admin credentials still cannot reach.
- Test identity recovery. Practice the identity recovery steps in advance, rather than working them out for the first time during an actual incident. Be sure to separate identity recovery from general disaster recovery drills and track time to a verified clean identity state alongside standard recovery time objectives.
- Isolate recovery infrastructure. To reduce the risk of reinfection, deploy a separate, disconnected environment for identity recovery that is cut off from the production network. Keep the accounts that manage backups separate from those that manage production identity, so that one compromised account can't access both.
- Verify identity integrity. Before declaring the recovery complete, verify that no shadow accounts or unauthorized access permissions are present and then return systems to production.
Sean Michael Kerner is an IT consultant, technology enthusiast and tinkerer. He has pulled Token Ring, configured NetWare and been known to compile his own Linux kernel. He consults with industry and media organizations on technology issues.
