Data Recovery, Measured in Lost Work for People and AI

How Much Legitimate Work Survives, How Narrowly You Can Restore, and Whether Microsoft 365 Copilot Sees the Restored Files

Key Takeaways:

• Recovery should be measured in lost work, not just whether files come back. Which version you get, how old it is, and how much legitimate work must be recreated. Ransomware makes the stakes extreme, but the same discipline covers everyday mistakes like deleted folders and bad overwrites.
• Panzura CloudFS narrows that gap with four capabilities working together: immutable, write-once objects that protect recovery history from accidents and attackers; a 60-second write interval; snapshots as frequent as every 15 minutes; and file- or folder-level restore guided by global search and activity audit, so unaffected work stays in place.
• Recovery now has two audiences. Through Panzura Nexus, restored content and permissions reach Microsoft 365 Copilot and AI agents in near file-time, with access evaluated from the underlying file permissions. A 12-question checklist helps buyers put every vendor’s resilience claims, including Panzura’s, to the test.

Cyber resilience often focuses on the threats that keep security teams awake such as phishing, stolen credentials, and ransomware. Those threats matter. But resilience is also tested by the less dramatic events that occur every week, like file deleted by mistake, a folder overwritten during a migration, or a contractor removing content they should not have.

The same recovery discipline applies in both cases. When file data is lost, changed incorrectly, or compromised, the business needs to know which version it can recover, how much legitimate work falls outside that version, and how much of the organization must stop working to restore service.

Ransomware makes the stakes extreme. The capabilities that limit its damage also reduce the cost of everyday mistakes.

File data now has more consumers than the humans who use it every day. Assistants such as Microsoft 365 Copilot can use Panzura Nexus to search, summarize, and reason over the same content. As organizations adopt agentic AI, systems may use that content to complete tasks, draft documents, or support decisions. Recovery must therefore restore not only user access, but also the content and permissions that AI systems rely on.

Ransomware is now involved in 48% of all breaches, according to Verizon’s 2026 Data Breach Investigations Report. Most ransomware protection promises that you will get your files back. The harder question is which version you get back, how old it is, and how much legitimate work may need to be recreated.

Recovery restores access to a prior version of data. Changes made after that version are not included in it. If the available recovery point is from the previous night and an incident occurs in the afternoon, recent work may fall outside the available restore point.

The industry calls that gap the gap the recovery point objective, or RPO, and , and usually expresses it in an amount of time. In practice, it represents the work a business may need to recreate after a data loss event. That result depends on at least three things: how frequently changes are protected, how a suitable recovery point is selected, and whether recovery requires reverting an entire share or only the affected files.

Getting back to work is often slow. In the Sophos State of Ransomware 2026 survey, only 16% of organizations recovered in less than a day.

Data recovery should be evaluated as a business-continuity investment, not merely as a storage or backup feature. The measure of resilience is not whether files can be restored. It is how much legitimate work survives, how quickly the business can resume, and how much of the organization is affected.

The cost of a broad recovery point

Lost work represents that work that must be recreated because it falls outside the selected recovery point, plus the work disrupted by restoring files or systems that were not affected by the incident.

It has several components. Teams may need to redo work completed between the recovery point and the incident. Deliverables may slip, decisions may be postponed, and revenue-generating activity may be interrupted. A broad rollback can also revert legitimate changes outside the affected files. Recovery itself consumes time from incident-response, storage, backup, security, and application teams. Meanwhile, staff may be unable to complete new work while they reconstruct files or wait for access.

Consider an illustrative example. A 40-person engineering team works from a shared project folder. Its recovery point is from midnight. At 3 p.m., a user accidentally deletes files in one project directory.

If recovery requires restoring the entire share to midnight, the team may need to recreate the day’s revisions. It may also lose unrelated changes made elsewhere in the share. If recovery can be limited to the affected folder and use a recovery point close to the incident, the scope of recreation is smaller and unaffected work remains in place.

If 40 people spend four hours recreating work, the direct labor impact is 160 hours. The full business impact also includes delayed deliverables, management time, customer commitments, and incident-response cost. The exact result depends on the recovery point, incident scope, and restore method.

Recovery history must survive accidents and attacks

Recovery history must survive both accidents and malicious actions. An administrator may shorten retention by mistake. A compromised account may attempt to remove recovery points. A privileged user may alter data in ways that are difficult to undo.

Protecting recovery history preserves the organization’s ability to recover without depending on the cooperation of an attacker or on recreating work that should have been recoverable.

In a 2024 Sophos survey of ransomware victims, 94% said attackers tried to compromise their backups, and 57% of those attempts succeeded. Organizations whose backups were compromised paid the ransom 67% of the time, compared with 36% for the rest, and their median recovery cost was eight times higher.

A recovery design should make clear where recovery points live, which identities and interfaces can alter or remove them, and which controls constrain administrative actions. If recovery history can be changed through a retention setting, buyers should establish who can change that setting and what prevents unintended or unauthorized changes.

Some platforms allow retention changes to remove older recovery points. In those cases, safeguards against deletion may be default behavior, optional configuration, or dependent on specific administrative permissions. Those distinctions matter during an incident.

Panzura CloudFS writes changed data to object storage as encrypted, write-once objects. Once written, those objects cannot be modified through the file protocol. Recovery-point selection and retention are separate operations, so buyers should validate which administrative actions can affect recovery history.

Table 1. Cyber resilience evaluation questions

Reduce the gap between work and recovery

The recovery point determines how much recent work is available. More frequent preservation of changed data reduces the potential gap between the last protected version and the loss event. That applies whether a user deletes a file, a team overwrites a model or contract, a script moves files to the wrong location, or ransomware begins encrypting data.

Recovery point is often quoted as a single number. In CloudFS, it comes from two mechanisms that perform different jobs. The first is the write interval. Every 60 seconds, changed data is written to object storage as new immutable blocks. The process is continuous and automatic. It does not depend on a nightly job.

The write interval determines how recently changed data has been preserved. It does not, by itself, establish that a version is safe to restore. Recovery teams still need to identify the affected scope and select an appropriate recovery point.

Frost & Sullivan cited a 60-second RPO, the best in the industry, when it named Panzura in its Frost Radar for hybrid cloud storage. Buyers should confirm which recovery workflow and operating conditions apply to that result.

Select the right recovery point

The second mechanism is the snapshot schedule. A snapshot is a read-only, point-in-time reference to blocks that already exist and cannot change.

Snapshots run on a schedule set by the administrator, with a minimum interval of 15 minutes for CloudFS. Organizations can tune the schedule to their own activity. For example, they can choose hourly during quieter periods, and as frequently as every 15 minutes when users are creating and changing the most content.

The write interval and snapshot schedule serve different purposes. The write interval preserves changed data. The snapshot schedule creates named points from which recovery can be selected. Buyers should talk to a Panzura expert to confirm how the platform supports recovery between named snapshots and which workflow applies in each case.

Snapshots use redirect-on-write, so no data block is overwritten to create one. No data moves, and there is no practical limit on how many snapshots can be retained.

How long snapshots are kept is a retention setting. Whether one can be destroyed is a separate matter. A CloudFS snapshot cannot be deleted through the file protocol. It is not a folder that a privileged user can navigate to and remove.

Table 2. Panzura CloudFS write interval and snapshot schedule

Recovery should match the size of the mistake

The recovery point determines how much work is missing. The restore scope determines who else is affected. Recovery should match the size of the mistake. Restoring an entire share to fix one deleted folder creates a new problem in which unrelated work is reverted.

A broad rollback can restore access to a prior version of a share or estate, but it may also revert legitimate changes outside the files affected by the incident. Granular recovery capabilities vary by platform. Buyers should establish whether recovery can be limited to individual files or folders, how recovery points are selected, and which metadata or permissions are restored.

CloudFS recovers at the size of the incident. Global search finds files that were deleted, moved, or renamed across the estate, and file activity audit shows who or what touched them. Recovery teams use that information to identify the affected scope and select an appropriate recovery point.

During an incident, responders need to establish which files changed, which users or systems touched them, which folder was affected, and when suspicious activity began. Search and activity records provide that evidence. AI assistants can help authorized teams query that information in natural language, subject to the same permissions and audit controls as other users. AI can make evidence more accessible, but it does not replace the recovery team’s validation and decision making.

The affected file or folder can then be restored in place from a named snapshot. Unaffected work stays where it is. Any CloudFS site can serve any data, so a location taken offline during the incident does not become a separate recovery project afterward.

File- or folder-level recovery can preserve unaffected changes without requiring a broader rollback. The amount of work recreated depends on the recovery point selected, the scope of the incident, and the containment measures required.

Build recovery confidence

Recovery confidence is the ability to know, before an incident, which recovery points are protected, how much work may be lost at each point, how narrowly recovery can be applied, and how the workflow will perform under incident conditions.

It depends on more than storage technology. Detection, containment, identity security, endpoint protection, and incident response remain essential. A file platform’s recovery capabilities are one part of that consideration.

Buyers increasingly seek evidence that recovery workflows can be validated under realistic conditions. Panzura is a Representative Vendor in the 2026 Gartner® Market Guide for Cyberstorage and is recognized in the 2026 Gartner Market Guide for Hybrid Cloud Storage. In our view, the move from reactive recovery to recovery confidence is the shift the cyberstorage category reflects.

Recovery confidence comes from four capabilities working together. Namely, protected recovery history supports recovery after accidental, unauthorized, or malicious change; frequent preservation reduces potential work loss; granular restore limits collateral disruption; and search and activity audit support a faster, better-informed restore decision.

Recovery for people and AI

Recovery now has two audiences. It spans the people who need to resume work and the AI systems that help them do it.

If your organization uses Microsoft 365 Copilot, AI needs to search, summarize, and reason over the same files your teams use. As organizations adopt agentic AI, systems may also use file content to complete tasks, draft documents, or support decisions.

Panzura Nexus makes CloudFS file data available to Copilot without requiring a separate data lake or migration project. Content and permission changes in the file platform reach Panzura Nexus in near file-time, so AI works from the same live files that your people use.

After recovery, a restored file or folder must become available to the people who need it, with the correct permissions and AI access aligned to the restored state. With Panzura Nexus, access is evaluated at query time from the underlying file permissions. If a user cannot open a file, they cannot reach it through AI. When access is revoked during an incident, the change takes effect in near real time.

Agentic AI raises the requirements further. An agent should operate under a defined identity, use only authorized content, and leave an auditable record of the actions it takes. CloudFS and Nexus can provide the governed file foundation for those workflows, but the agent’s identity model, tool permissions, and audit controls must be validated with the AI platform and workflow in use.

Evaluation checklist

Every file platform now claims ransomware protection and data resilience. These questions help establish what is behind the claim. Put them to every vendor on your list, including us.

1. If a user deletes a critical folder, how quickly can we restore it without reverting unrelated work?
2. If a file is overwritten by mistake, can we identify and restore a prior version?
3. If a compromised account alters or deletes files, how do we identify the affected scope and select a safe recovery point?
4. If ransomware affects shared file data, can recovery history be preserved and used without paying a ransom?
5. How frequently is changed data preserved, and which recovery points can be selected through supported workflows?
6. What dependencies, validations, and containment steps are required before the business can resume?
7. How quickly does new or changed file platform data become available to Microsoft 365 Copilot through Panzura Nexus?
8. How are file permissions enforced for AI queries, and which system makes the final authorization decision?
9. After a file or folder is restored, when does it become available to AI, and how is its indexing refreshed?
10. When a file is deleted or access is revoked, how quickly is it removed from AI results?
11. Can an AI agent access CloudFS data, and under which identity, permission model, and audit controls?
12. Can AI-assisted search help authorized responders identify affected files during a recovery exercise?

Ask each provider to run a scoped recovery exercise in your environment. Record the recovery point used, the time required to restore access, the scope of changes reverted, the work preserved, the work recreated, and the conditions required for recovery. Include AI access in the test: confirm when restored content becomes available to assistants and agents and verify that permissions continue to apply.

Single-site firms can ask the same questions. Panzura Express is CloudFS for one location, with the same recovery mechanism and Panzura Nexus included.

Learn more about Cyber Resilience with Panzura. Next in this Cyber Resilience blog series: the attacker is already logged in. The series ends with a live webinar, “Three Questions to Ask Every File Platform About Cyber Resilience in the AI Era,” with Darrin Chapman and Raul Sanchez.

Frequently Asked Questions (FAQs)

• What is a recovery point objective (RPO) in practical terms?

  A recovery point objective, or RPO, is usually expressed as an amount of time, but in practice it represents the work a business may need to recreate after a data loss event. Recovery restores a prior version of data, and any changes made after that version are not included. If the available recovery point is from the previous night and an incident occurs in the afternoon, the day’s work falls outside the restore. The real RPO depends on three things: how frequently changed data is protected, how a suitable recovery point is selected, and whether recovery requires reverting an entire share or only the affected files.

• How should organizations measure the cost of data recovery?

  Measure recovery in lost work, not just whether files come back. Lost work has two parts: work completed between the recovery point and the incident that must be redone, and legitimate work disrupted when unaffected files or systems are rolled back. Consider a 40-person engineering team with a midnight recovery point. If a user deletes a project folder at 3 p.m. and the whole share is restored to midnight, the team recreates a day of revisions and loses unrelated changes. Four hours of rework across 40 people is 160 hours of direct labor, before counting delayed deliverables, management time, and incident-response cost.

• Why must recovery history survive both accidents and ransomware attacks?

  Recovery points are only useful if they still exist when you need them. An administrator can shorten retention by mistake, a compromised account can attempt to remove recovery points, and a privileged user can alter data in ways that are hard to undo. Attackers target backups deliberately. In a 2024 Sophos survey, 94% of ransomware victims said attackers tried to compromise their backups, and 57% of those attempts succeeded. Organizations whose backups were compromised paid the ransom 67% of the time, versus 36% for the rest, with a median recovery cost eight times higher. Protected recovery history removes the attacker’s leverage.

• What is the difference between the Panzura CloudFS write interval and the snapshot schedule?

  The two mechanisms do different jobs. The write interval preserves changed data. Every 60 seconds, Panzura CloudFS writes changed data to object storage as new encrypted, write-once blocks, continuously and automatically, with no dependence on a nightly job. The snapshot schedule creates named recovery points. A snapshot is a read-only, point-in-time reference to blocks that already exist and cannot change. Administrators set the schedule, with a minimum interval of 15 minutes, and can run snapshots more frequently during busy periods. The write interval determines how recently work was preserved. The snapshot schedule determines how precisely a recovery point can be selected.

• Can a Panzura CloudFS snapshot be deleted by a compromised or privileged account?

  A Panzura CloudFS snapshot cannot be deleted through the file protocol. It is not a folder that a privileged user can navigate to and remove. Snapshots use redirect-on-write, so no data block is overwritten to create one, no data moves, and there is no practical limit on how many can be retained. How long snapshots are kept is a retention setting, which is separate from whether one can be destroyed. Because retention is policy-controlled, buyers should still validate which identities, interfaces, and administrative actions can modify retention, and what safeguards prevent unintended or unauthorized changes to recovery history.

• How does granular file recovery reduce business disruption?

  Recovery should match the size of the mistake. Restoring an entire share to fix one deleted folder creates a new problem in that unrelated, legitimate work is reverted. The recovery point determines how much work is missing, but the restore scope determines who else is affected. In Panzura CloudFS, global search finds files that were deleted, moved, or renamed across the estate, and file activity audit shows who or what touched them. Recovery teams use that evidence to identify the affected scope, then restore the specific file or folder in place from a named snapshot. Unaffected work stays where it is, and no site becomes a separate recovery project.

• With Panzura Nexus, does Microsoft 365 Copilot see files after they are restored?

  Yes, when file data reaches Copilot through Panzura Nexus. Panzura Nexus makes Panzura CloudFS file data available to Microsoft 365 Copilot without a separate data lake or migration project, and content and permission changes reach Panzura Nexus in near file-time. Access is evaluated at query time from the underlying file permissions, so if a user cannot open a file, they cannot reach it through AI, and revoked access takes effect in near real time during an incident. Agentic AI adds requirements in that an agent should operate under a defined identity, use only authorized content, and leave an auditable record, which must be validated with the AI platform in use.