Recovery Is the Strategy; Everything Else Is Tactics

Assume the breach; fund the recovery. Order-of-restoration, tested restores, and practiced trees beat tool sprawl.

Prevention has a floor: good controls, sure, but never zero. Strategy built on a breach never occurring is a wish with a budget line.

Assume it; then what

The useful planning question becomes order: what restores first, who decides, and what does "back to business" measurably resemble. Without that list, ransomware day is tasked improvisation, and improvisation is a tax you pay in overtime and goodwill.

Fund the three Boring things

• Restores tested quarterly, including the fiddly one nobody likes to talk about: domain controllers, not just file shares
• Off-glass copies: backup reachable when production identities leak
• A call tree exercised annually, numbers included, and a decision sheet pre-signed for the 3 a.m. branch

Tactics fund themselves once order exists

MFA everywhere it is cheap, EDR where it earns, segmentation where it fences — all easier to prioritize when the endgame is written down. The org that can demonstrate last quarter's test-restore sleeps differently. Quantity of antivirus loneliness predicts nothing.

Recovery first isn't defeatism. It's the only plan that tracks reality on its own terms.