Ransomware Dominates Breaches, Shifting Cybersecurity Focus to Identity Resilience Ransomware remains a dominant threat, accounting for 44% of all breaches in 2025, according to Verizon’s Data Breach Investigations Report. The impact is even more severe for small and midsize businesses (SMBs), where ransomware plays a role in nearly 90% of breaches, compared to 39% for large organizations. Attackers increasingly target privileged accounts and identity infrastructure, such as Active Directory, to escalate access and lock out legitimate users within minutes. Even after data restoration, a compromised identity layer can prolong recovery, leaving organizations unable to regain control of their systems. As a result, identity recovery has become a cornerstone of cyber resilience. Identity systems are deeply embedded in authentication and access workflows, making their recovery critical to preventing reinfection. Security leaders now prioritize secure restoration to ensure attackers cannot re-enter compromised environments. The issue has escalated to board-level concern, with regulators and cyber insurers demanding tested recovery plans, immutable backups, and defined recovery time objectives (RTOs). Frameworks like GDPR and CCPA impose penalties for prolonged downtime, pushing organizations to adopt recovery engineering a structured, automated approach that aligns technical recovery with business priorities. Key capabilities for resilience include: - Identity resilience: Immutable backups and automated recovery for identity systems. - Zero-trust architecture: Least-privilege access and continuous authentication to limit attack spread. - Automated orchestration: Reducing manual steps to accelerate response times. - Regulatory readiness: Integrating compliance validation into resilience planning. - AI-ready protection: Securing data environments against autonomous threats with fast rollback capabilities. - Backup platform isolation: Treating backups as a separate security domain for minimal viable recovery. Companies like Cognizant and Rubrik are addressing these challenges with integrated solutions. Rubrik offers immutable storage, ransomware recovery, and Active Directory restoration, while Cognizant provides orchestration and domain expertise to align recovery with business continuity and compliance needs. Together, they aim to strengthen cyber resilience through a unified, service-based model.

Rubrik, a data protection and cybersecurity firm, faced a security breach where unauthorized activity was detected on a server holding log files. Although the server was compromised, no evidence suggested customer data or internal code was accessed. The incident involved compromised access information, the specifics of which were not disclosed. As a precaution, Rubrik rotated keys to mitigate risks and has fully mitigated the issue, assuring that the access information was not misused. The event showed potential risks regarding vendors' customers, similar to past incidents with other companies.

The ransomware organization obtained company data by taking advantage of a recently discovered zero-day vulnerability in the Fortra GoAnywhere secure file transfer platform, according to a data breach uncovered by cybersecurity company Rubrik. With outside forensics professionals' aid, Rubrik immediately started an inquiry into the occurrence. It was discovered that installations with management interfaces and administrative consoles that are not accessible through the Internet are secure. The incident was promptly closed and only affected a non-production IT testing environment, according to a statement released by Rubrik.