Endpoint recovery surprises

How long would it actually take your organization to recover every endpoint after a major cyber incident?

Recording live from IGEL Now And Next in Miami, I sat down with James Millington to explore a question that most businesses think they've answered, but rarely have. Because when you move beyond theory and start mapping out the real process, the numbers tell a very different story.

James shared examples from real organizations that tried to calculate recovery at scale. One estimated it would take over 5,000 person-hours to rebuild their estate. Another believed they could recover quickly, until they realized the scale of their environment made that assumption unrealistic. It raises a deeper question. Are we focusing too much on recovery and not enough on resilience?

The conversation quickly moved into what James calls the "endpoint recovery gap." While most organizations have invested heavily in data center resilience, failover environments, and backup strategies, far fewer have a clear plan for reconnecting users when endpoints are compromised. And without a working endpoint, even the most advanced infrastructure becomes inaccessible.

We also explored why so many organizations continue to rely on reimaging devices as a primary recovery strategy, despite the time, complexity, and operational disruption it creates. In many cases, it's not just slow. It's impractical at scale. And perhaps more concerning, some organizations still admit to having no defined plan at all.

One of the most memorable moments in the conversation came through a simple analogy. For years, we've been carrying the weight of outdated endpoint strategies, even though the solution has been sitting in front of us. Just like it took thousands of years to put wheels on a suitcase, the shift toward simpler, more resilient models often requires a moment of realization before change actually happens.

As application delivery continues to move toward SaaS, DaaS, and cloud environments, the role of the endpoint is also being redefined. Analysts are now calling for a move toward immutable, non-persistent endpoints that reduce attack surface and enable faster recovery. But as James points out, the real challenge is not awareness. It's an action.

As organizations continue to invest in security, infrastructure, and AI, one question remains: Are we still planning for recovery from failure, or are we finally designing systems that avoid it in the first place?

What do you think, are businesses ready to rethink endpoint strategy, or are we still carrying the baggage of the past?