Jim McGann is CMO at Index Engines.
Most ransomware recovery plans rest on one assumption: When recovery begins, the organization knows which data it can trust. But that assumption is getting harder to defend.
Enterprises have invested in prevention, immutability, segmentation and isolated vaults. Those investments protect copies of data, but they leave a harder question open: Is the data inside those copies intact? Has it been obfuscated by bad actors?
Our research lab collects an estimated 3,500 unique ransomware samples a day, selects the most novel and unique candidates, then detonates them in a controlled environment to see what they do to data. The pattern is clear. Attackers have learned that uncertainty can do as much damage as destruction.
Ransomware has learned to hide.
The old model was easy to picture. A healthy file became an encrypted file, and a ransom note followed.
Based on our lab research, which has analyzed over 7,500 ransomware variants since its inception, partial encryption appeared in nearly a third of the 1,064 strains our research team documented in the first half of 2026. An attacker can encrypt a fraction of a file—even a few bytes of data—and render it useless. Other techniques preserve file extensions, manipulate time stamps, corrupt headers and suppress the entropy and encryption changes to evade detection tools.
Our research also found that more than half of the new ransomware variants are polymorphic. They constantly morph and change their identity and the resulting file signature. This hides the malware from signature scanning tools and renders them useless.
Each technique serves the same goal. Attackers study what defenders watch for and adjust. Yesterday’s indicators are a poor guide to tomorrow’s attack.
The search for a trusted recovery point is becoming harder.
Now apply those techniques to a production database. Financial transactions, patient records, ERP systems, order processing and identity infrastructure all run on databases. Subtle corruption in these systems can halt the business even after every server is back online.
And that corruption travels. Snapshots taken after the attack began capture corruption along with everything else. Say you discover an attack today. You have hundreds of snapshots to choose from. The attacker may have started corrupting data days or weeks ago. Which copy do you restore?
Without knowing when the corruption started or how it works, recovery teams fall into a loop. Restore a recovery point. Test it. Find more damage. Step further back in time. Repeat. Each cycle burns hours the business cannot spare. Recovery becomes forensic reconstruction under pressure.
Uncertainty spreads beyond IT.
Once recovery stalls, the questions change hands. Executives, regulators, insurers, customers and the board want answers. What was affected? When did it start? What regulated data was involved? Which recovery point can be trusted? When will operations resume?
Unclear answers create new exposure. Regulatory reporting deadlines approach. Insurance claims need documentation. Customers may need notification. Contracts carry obligations. The board wants a timeline. Revenue and supply chains absorb the damage while those questions stay open.
An attack may start in IT, but recovery uncertainty reaches finance, legal, compliance, operations and the boardroom. Every hour spent establishing trusted data extends the disruption and impacts organizations’ bottom line.
Importantly, while immutable, isolated and offline copies help ensure data remains available after an attack, they do not guarantee that the data inside those copies is clean. If corruption occurred before a snapshot was taken, the backup can preserve that corruption indefinitely. A recoverable copy is not necessarily a trustworthy recovery point.
Make attacker research part of recovery planning.
Security teams already study how attackers gain access, move laterally and evade endpoint tools. Recovery teams need the same intelligence about how attackers manipulate data. That intelligence can come from internal teams, industry partners or specialized research labs, but it has to be current.
Leaders should be able to answer these questions before an incident:
• What techniques are current ransomware variants using?
• How would those techniques affect our most critical data?
• Can we detect subtle corruption?
• Can we determine when corruption began?
• Can we identify the last known good recovery point quickly?
• Have we tested recovery against current attacker behavior?
In my experience, I’ve found that the decision is either to answer these questions now or to answer them mid-attack when every hour of uncertainty carries a cost.
The recovery race has started.
Attackers refine their methods every day. Organizations that study those methods can better understand what happened, find trustworthy data and restore operations faster. Organizations that skip that work may find themselves doing ransomware research for the first time while executives, regulators and insurers wait for answers.
The next ransomware attack may leave your protected data seemingly intact yet covertly obfuscated. The greater danger is thinking you can trust it when you can’t.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?