How to Prevent Disruption and Recover Quickly When it Matters Most

What happens when a cyberattack doesn’t just breach systems but halts your business? Recent incidents show downtime is the true cost. This blog breaks down CISA guidance and how to build resilience to stay operational, even under attack.

The cyberattack against Stryker Corporation was not just a breach. It was an operational disruption.

This incident reflects a broader shift in cyber risk. The downtime resulting from cyberattacks can severely hamper an organization’s ability to function effectively and potentially lead to compliance violations. In fact, 83% of organizations have experienced operational disruption following a cyber incident[1], highlighting how quickly security events can escalate into business disruption. In a recent study of 750 CISOs across organizations of all sizes, a vast majority reported 3–14 days to restore operations, while only a small percentage reported 1 day or less.[2] Furthermore, across Global 2000 companies, downtime is estimated to cost more than $400 billion annually — roughly 9% of total corporate profits.[3]

With so much at stake, securing systems through prevention is simply not enough. Organizations must employ robust cyber resilience and recovery mechanisms to limit the risk of lasting downtime to their business.

In response to the attack against Stryker Corporation, CISA published a set of advisories for U.S. organizations to follow, outlining steps to harden trusted software such as Endpoint Management against potential tampering and infiltration. CISA has outlined the following recommendations, while mentioning Microsoft Intune as an example given that it was utilized in the attack against Stryker Corporation:

This guidance is particularly pertinent today given the heightened geopolitical tension worldwide. Targeted cyberactivity often follows geopolitical escalation so organizations should assume an elevated risk for the foreseeable future. In addition to CISA’s recommendations, we at Absolute encourage organizations to take steps in reviewing their endpoint and network configurations and ensuring cyber resilience to limit the potential impact of downtime. Cyberattacks causing downtime are often initiated through seemingly rudimentary security lapses or exposures that are entirely avoidable. Examples include:

To combat such challenges, we encourage organizations to strengthen their cyber resilience to establish the following outcomes:

Ensuring resilience across both endpoint and network access matters as endpoint compromise impacts access to critical applications, hampering productivity and causing downtime. Without the appropriate recovery and access control mechanisms in place, disruption spreads, causing material impact to business operations. To achieve the outcomes listed above, organizations can take the following practical steps right away:

Most organizations don’t know their readiness or impact of potential downtime on their business operations. To help gauge your organization’s preparedness, check out the following resources:

Given the heightened global cyberactivity risk, organizations must stay vigilant before it’s too late. CISA’s guidance around the safe usage of trusted and legitimate products such as Endpoint Management is critical in employing security best practices. Embedding cyber resilience into your IT and security operations is equally vital in keeping your business running when an incident does strike. Ultimately, stopping downtime involves having the means to proactively prevent incidents as well as recover from them effectively if they do occur.

1 Uncovering Downtime’s $400B Impact

2 The CISO Board Prep Success Guide: The 4 Pillars of Business Resilience

3 Uncovering Downtime’s $400B Impact

Zero Trust is essential for securing hybrid work. Discover how it strengthens endpoint security and minimizes risk in remote environments.

Exciting new capabilities enable IT and security teams to better manage their digital environment.

As cyber threats in education rise, K-12 schools must secure their remote learning environments. Absolute helps protect sensitive data and ensures resilient security.