A breach forces a decision before it produces a clean technical answer. The company still has to
operate, the cause still has to be understood, and payment may or may not be part of the path. This
short exchange from the Orange Hat Tech Summit 2026 is about that recovery problem. Brian Doty
walks through what has to be in place so the team has options after an attack, not a single bad choice
made under pressure.
His point is cyber resiliency, not a backup job nobody has restored. Backup is the copy. Business
continuity and disaster recovery are the plan that goes with it. That plan has to include a way to
virtualize systems so people can work while the original environment is examined. It also has to keep
an intact set of systems off to the side. That copy is what a forensics review uses to see what
happened and what failed. Without it, the team is cleaning the only evidence they have. A tested
restore is one safeguard. It does not, by itself, decide whether a payment is warranted.
A written policy is the other half of the point. Knowing what to do is not the same as having a standard
process that can be run under pressure. Brian described a prior employer's client where antivirus was
circumvented, isolation did not hold, and engineers pulled network cables trying to stop the spread.
That company had about 18 systems. Cleanup still took about five days and two people working around
the clock, including a manual pass with a different antivirus product. This page does not present that
incident as a Solomon IT case. It is the example used on stage to show what an unplanned recovery
looks like.
Owners and operators who carry downtime risk should watch the clip, then check whether their own
recovery plan has been tested. Staff who would be told to just restore it should watch it too. The video
is not a product demo, and it is not advice to refuse a demand. It sets a planning standard: a written
plan, an isolated copy, a path to virtualize, and a process you can follow while the payment question is
still open.
Key Takeaways
Recovery is cyber resiliency: business continuity and disaster recovery, not a backup job by itself.
The plan has to include a way to virtualize systems so downtime stays short while the original environment is examined.
Keep an intact copy off to the side for forensics. Brian described that as close to a second infrastructure.
A tested restore is one safeguard. It may change the options on the table. It is not a reason to treat payment as settled either way.
A written backup and disaster recovery policy is what turns knowing what to do into a standard process.
In the on-stage example, isolation failed. About 18 systems took two engineers roughly five days, including a manual cleanse after the first antivirus product was circumvented.