I’ve just been talking to my colleague Luis about his recent learnings from his attendance at the PASS Summit East in Chicago. One topic that caught my attention and has consistently been surfacing in customer conversations recently is how ransomware is changing how organisations think about SQL Server disaster recovery.
At the summit, security was no longer treated as a separate topic from disaster recovery.
Across sessions focused on SQL Server security, ransomware resilience, operational recovery, and compliance, one message emerged clearly:
Recovery capability is now a core part of an organisation's cybersecurity posture. At the same time, evolving cybersecurity threats are changing what organisations need from their disaster recovery strategy.
For many years, disaster recovery planning focused primarily on infrastructure failure, natural disasters, or isolated system outages. But today, ransomware, data exfiltration, and prolonged breach detection windows have fundamentally changed that conversation.
Organisations are increasingly recognising that the speed and reliability of database recovery directly impact both operational risk and cybersecurity exposure.
One of the more sobering discussions at PASS Summit centred around how modern ransomware groups now operate. And the challenge is no longer simply encrypted systems.
Today’s attackers increasingly focus on:
Data exfiltration
Intellectual property theft
Operational disruption
Extortion through public exposure (and the massive public credibility impact this can have)
Several security-focused sessions referenced industry reporting showing that breach detection can take months, meaning attackers may have extensive access before organisations respond.
Longer detection times mean recovery may require:
Rapid isolation
Known-good recovery points
Clean standby environments
Verified recovery procedures
Operational continuity under pressure
For SQL Server teams, this creates growing emphasis on recovery readiness rather than simply backup retention. "Readiness" does not just mean faster failover, but more importantly "fast failover failover to known-good recovery points". This distinction is important because fast failover from a corrupted/infected backup would cause even more harm.
Backups remain critically important.
However, many conversations at PASS Summit reflected growing concern around whether backup-only recovery approaches are sufficient for modern operational expectations.
Common concerns included:
Backups becoming a primary ransomware target
Long restore times
Backup corruption risks
Operational complexity during crises
Limited recovery testing frequency
Several DBAs also openly discussed concerns around recovery estimates that look reasonable on paper but prove difficult under real-world conditions.
This gap between theoretical and operational recovery capability is becoming increasingly important. For DBAs and Managers, being able to tick the box is not enough. The increased frequency of threats and the cost of downtime mean teams must be able to trust their recovery systems.
One of the most practical observations from PASS Summit discussions was that downtime itself has become a major security and business continuity issue.
The longer systems remain unavailable the greater operational disruption becomes, the more pressure organizations face during incidents, the higher the financial impact, and the more leverage attackers may perceive they have.
As a result, many organisations are increasingly prioritising:
Faster failover procedures (including faster speed in verifying known-good recovery points)
Continuous standby validation
Lower operational complexity
Recovery testing frequency
This shift mirrors broader cybersecurity guidance from organisations like NIST and CISA, both of which increasingly emphasise operational resilience alongside prevention. We also see this in the demands insurance companies begin to place on customers.
Another recurring theme throughout PASS Summit was audit readiness. Compliance teams and auditors increasingly expect organisations to demonstrate recoverability rather than simply document backup procedures.
Compliance teams are expecting organisations to document items such as:
Recovery testing
Recovery time objectives
Operational verification
Monitoring and alerting
Several attendees noted that proving recoverability often remains difficult because DR testing itself can introduce operational risk, making frequent testing difficult.
This creates increasing interest in Dissater Recoery testing approaches that support:
Automated validation
Continuous verification
Lower-risk testing procedures
Compliance reporting
Perhaps the biggest takeaway from PASS Summit Chicago is that cybersecurity and disaster recovery are converging operationally. SQL Server recovery planning is no longer just about infrastructure redundancy. It is increasingly about maintaining operational continuity under adverse conditions.
For DBAs, architects, partners, and infrastructure leaders, this means recovery strategy now plays a direct role in not just application availability, but also cyber resilience, operational continuity, compliance, and business risk management.
Organisations that can recover quickly, verify recovery readiness consistently, and reduce operational uncertainty are in a stronger position than those relying solely on theoretical recovery plans. PASS Summit reinforced that the future of SQL Server operations will depend not only on prevention, but on confidence in recovery.