Business continuity in one of the world’s most targeted countries | Building an effective BCP and understanding advances in cloud disaster recovery

GREEN: Planning, prioritization and testing for every organization   |   AMBER: Cloud DR deployment with qualified IT support

For: Small and medium-sized businesses · Organizations with cloud or on-premises servers · Business leaders and IT managers · Risk levels: Green / Amber · As of October 2026

The key takeaway

Israel is among the countries most heavily targeted by cyberattacks. Years of ongoing conflict also expose organizations to physical disruption and workforce risks that many other countries do not face. A business continuity plan (BCP) must be more than a document filed away for an emergency; it must be a capability tested in practice. Today’s cloud disaster recovery (DR) tools have made one of its most expensive and complex elements, the alternate recovery site, potentially affordable for a medium-sized business under the right conditions, with testing possible every month.

What the numbers tell us

A leading target: According to Radware’s report on cyber threats in 2025, published in February 2026, Israel was the world’s leading target for geopolitically motivated attacks, accounting for 12.2% of all such attacks recorded globally and 1,881 claimed attacks, ahead of the United States and Ukraine. Microsoft’s Digital Defense Report, published in October 2026 and covering July 2025 through June 2026, ranks Israel second worldwide by the volume of observed attack activity. The same report states that 39% of activity by Iran-linked actors targets Israel, and that ransomware incidents in Israel rose by 21% in a year when the global total declined.

Conflict extends into cyberspace: The Israel National Cyber Directorate reported approximately 26,500 contacts to its 119 hotline in 2025, up 55% from 2024. Monthly contacts peaked at 3,645 in June 2025, during the confrontation with Iran. Directorate head Yossi Karadi summed it up in a single sentence: there is no ceasefire in cyberspace.

What the reports do not capture: In our experience, the disruptions affecting clients over the past two years have extended well beyond hacking. Key employees have been called up for prolonged reserve duty; air-raid alerts have emptied offices during the working day; power and communications have failed; and employees have been unable to reach their workplaces. In our assessment, business continuity in Israel must address these scenarios as well as ransomware.

Backup is not business continuity

Backup answers one question: is there a copy of the data? Business continuity answers another: how quickly can the organization resume production, sales, deliveries and payroll, and who does what in the meantime? This distinction matters. In the past, a computer outage might have brought the office to a halt while the factory kept running. Today, production itself depends on IT in most companies: machine control, weighing, delivery documentation, inventory and order management. Without their systems, most businesses cannot produce, let alone sell. The gap between these two questions usually becomes apparent at the worst possible moment. A June 2026 study by the Acronis Threat Research Unit, based on platform data from the first quarter of 2026, found that recovery point objective (RPO) monitoring was disabled on 85% of recovery servers, while 82% of active test rules on the platform were configured without automated failover testing. According to the researchers, and in our assessment, many organizations that have already paid for DR do not know whether it will work. In our experience, this is a matter of operating discipline rather than a failure of the technology.

A practical approach with five components in sequence

1. Business impact analysis (BIA): Before purchasing anything, management defines which processes must be restored first, how long they can remain unavailable (the recovery time objective, or RTO), and how much data loss is acceptable (the RPO). In our experience, three to six systems make up the core of most businesses, while the rest of the environment can wait several days. Making that distinction can substantially reduce the eventual cost.
2. An independent immutable copy: Maintain at least one backup copy outside the production environment. At least one copy, whether that same copy or an additional one, should be locked for a defined retention period so that even an attacker with administrator privileges cannot delete or encrypt it. Without this protection, the rest of the plan depends on the assumption that the backup will survive the incident.
3. A cloud recovery site instead of a second physical site: This is the component that has changed. For years, DR meant a second data center, duplicate hardware and duplicate maintenance. In our experience, most medium-sized businesses opted out. With Acronis Disaster Recovery, recovery servers are preconfigured from existing backups and started in the cloud only when needed. According to the vendor’s documentation, runbooks can define startup sequences and dependencies between servers. Test failovers can run on an isolated network without affecting production. Automated weekly or monthly tests can verify that a server starts and capture a screenshot. Monitoring can check whether the latest recovery point meets the RPO target. Once the original environment has been repaired, incremental failback transfers only the changes while the cloud server continues running. According to the vendor, costs depend on product licensing, DR storage, compute resources while servers are running, including during tests, and public IP addresses where required. Routine operation therefore maintains recovery capability rather than a second data center. One qualification is essential: the vendor does not publish a recovery time and states that it depends on the tested configuration. That is why the next component matters.
4. Routine testing and measurement: Untested DR remains an assumption. Run an automated failover test every month, perform a timed full recovery of a core server every quarter, and record the actual recovery performance against the target established in the BIA. In our experience, the first measurement almost always produces a surprise. That is precisely why it should happen on an ordinary working day rather than during an incident. In our previous article, we described a client engagement in which a four-hour target turned into days: RTO Targets on Paper and Recovery Speed in Practice.
5. People and procedures: Define who declares an incident, who takes over if that person is on reserve duty, how teams communicate when corporate email is unavailable, and how sales and dispatch continue manually while systems are down. If the connection to the cloud is lost, there may be nothing to restore; the immediate need may simply be to wait for connectivity to return. A manual procedure can make the difference between a lost business day and a difficult but productive one, at relatively low cost.

Risks and considerations

Configured DR is not necessarily ready DR: In the same Acronis study, the most common DR alerts in the first quarter of 2026 concerned VPN connections (35.4% of alerts) and backup permissions (34.7%). These relate to the infrastructure supporting recovery, rather than the data itself. Monitoring, alerts and regular testing are integral parts of the solution.

Costs during an incident: Running cloud servers for days or weeks incurs costs. Decide in advance which servers will start and in what order, rather than automatically starting everything.

An attacker may be present in the backup: In ransomware incidents, attackers often remain in the network for days or weeks before encryption, and backups can capture that compromise. Recovery must therefore be clean: scan the recovery point, use clean operating systems and reset passwords before reconnecting.

Connectivity dependency: Any plan that relies on the cloud also relies on connectivity. In our experience, a second connection to the main site is often one of the most cost-effective elements of the entire plan.

Regulatory requirements: ISO 27001:2022, control 8.13 on information backup, requires backup copies to be tested regularly, not merely maintained. In our audit experience, sector regulators are also increasingly asking for evidence of recovery testing. Records from quarterly tests provide evidence for an audit as well.

Sources

• Radware, Global Cyber Threat Report 2026, as reported by The Times of Israel, February 19, 2026
• Microsoft Digital Defense Report 2026, as reported by CTech, October 1, 2026
• Israel National Cyber Directorate, 2025 year-end review, as reported by CTech, February 26, 2026
• Acronis Threat Research Unit, Why most DR deployments may not survive a real disaster, June 1, 2026
• Acronis Disaster Recovery, product page and capabilities overview
• Acronis documentation, Configuring automated test failover
• ISO/IEC 27001:2022, Information security management systems
• T.O.M, RTO Targets on Paper and Recovery Speed in Practice, September 8, 2026

© T.O.M at your service Ltd | The Experts in Creating Peace of Mind | tom-comp.com

#TOMTechTip #WeeklyTechTip #TOM_ITServices #BCP #DisasterRecovery #CyberSecurityIsrael