The attack was over.  The recovery was about to begin.

Standing in the middle of an organisation whose systems had fallen silent, it became clear that the most difficult part of the journey was still ahead. The immediate danger had passed, but every decision from that moment onward would influence how quickly the business recovered and, more importantly, how safely it could return to normal operations.

Many people imagine recovery as restoring servers, recovering files and bringing systems back online. The reality is very different.

Recovery is about restoring confidence.

Every decision carried weight. Which systems should return first? Which identities could still be trusted? Which devices might still contain traces of the attackers? Every answer meant balancing business continuity against the possibility of letting the attackers back into the environment.

One of the earliest decisions made by the leadership team was that the organisation would not pay the ransom. There was no certainty that encrypted systems would be restored, that stolen information would be deleted, or that the attackers would simply disappear. Years of investment in Business Continuity and Disaster Recovery had prepared the organisation for exactly this moment, and now it was time to trust those decisions.

Our immutable offsite backups became the foundation of the recovery. What surprised many people was that restoring the data turned out to be the easiest part.

Restoring trust was far more difficult.

Every workstation connected to the corporate network was rebuilt from scratch. To many employees this seemed unnecessary; their computers appeared to be working normally, and rebuilding every device meant additional downtime, disrupted routines and understandable frustration. But cybersecurity is built on trust. Once confidence in a system has been lost, assumptions are no longer enough. Every workstation, every server and every identity had to begin again from a known and trusted state.

Looking back, it was one of the most disruptive decisions we made, and one of the most important. The recovery followed a simple principle: recover safely before recovering quickly.

That principle shaped every decision that followed. Identities were restored before applications. Critical business services before convenience. Certainty before speed. It was tempting to accelerate, but experience reminded us that recovering quickly means very little if the organisation is not recovering securely.

The experience also changed the way I think about Business Continuity. Too often, disaster recovery plans are treated as documents prepared for audits or annual exercises, their real value discovered only on the day they are needed. Recovery does not begin when the incident occurs. It begins years earlier, when leaders choose to invest in resilience before anyone can justify its cost. That lesson has stayed with me ever since.

Eventually the systems were restored. Business operations resumed and the organisation found its rhythm again. From the outside, it appeared that everything had returned to normal. For those who lived through it, however, normal had acquired a different meaning.

Leading an organisation through a major cyber incident carries an emotional weight that is rarely discussed. Every decision affects thousands of people. Every hour feels significant. Every uncertainty becomes your responsibility. Even today, an unusual security alert or an unexpected system behaviour is enough to remind me of that weekend.

Some experiences never completely leave you. They quietly become part of the leader you are.