The Missing Budget Line
Between Prevention and Recovery

A cyber budget can look comprehensive and still leave its most consequential moment unfunded. A CISO asks for additional investment. The executive team can already point to endpoint protection, identity controls, EDR, SIEM, backup, cyber insurance, incident-response retainers and recovery platforms. The finance question is reasonable: what capability would the new investment buy that your organisation does not already have?

The answer is often obscured by the way the budget is structured. Most portfolios fund two necessary outcomes: reduce the likelihood of intrusion and restore services after damage. Far less attention is given to the period between them, when an attacker may already be using valid access, malicious movement is still possible, evidence remains incomplete and the eventual scale of recovery is still being determined.

The missing budget line is the capability to contain an active incident before an initial compromise spreads into a significant security breach and a much larger recovery programme.

Prevention is essential. It reduces exposure, removes known weaknesses, strengthens identity paths and blocks hostile behaviour before it affects operations. Recovery is equally necessary. Backups, rebuild procedures, restoration plans and specialist partners provide a route back when systems or data have been damaged.

Funding both capabilities does not make the model complete. Prevention does not decide what happens after an attacker enters through a valid identity, supplier connection, remote-management route or manipulated workflow. Recovery does not automatically reduce the number of systems touched, the data already reached, the forensic scope, the legal pressure or the duration of operational disruption.

Your organisation can therefore invest heavily at both ends of the incident and still lack a practical way to change its trajectory while malicious activity is continuing. Containment belongs in that active middle.

Strong recovery capability matters, but recovery is not the same as continuity. It begins with the damage, dependencies and uncertainty the incident has already created.

Backups may restore data and rebuild procedures may return systems to service. Neither can retract information that has already left, remove pressure from affected customers or employees, or make a wide shutdown commercially painless. A technically successful restoration can still leave a substantial legal, operational and communications burden.

Containment does not replace recovery. It reduces the burden recovery must carry by limiting how far malicious activity can spread, how much data can be reached and how many services become part of the response. Recovery answers how your organisation will return; containment determines how much must be recovered in the first place.

A backup may be available, a recovery partner may be retained and a restoration plan may be documented. Your business can still spend weeks operating below normal capacity while teams rebuild systems, validate identities and backups, reconnect services and establish what can safely return.

Sophos's 2026 survey of 2,158 organisations found that full recovery from ransomware took an average of three weeks. Fifty-five per cent recovered within one week, while 17 per cent needed longer than a month. The average recovery cost, excluding ransom payments, was USD 1.70 million.

Those figures do not calculate the return on our platform, and full recovery time is not identical to downtime. They show why the missing budget line matters. Recovery inherits the scope the incident has already created. Containment is funded to reduce that scope while it can still be changed.

Mature security programmes invest heavily in prevention for good reason. The weakness appears when the budget treats reduced probability as operational certainty.

Modern attackers often use paths that were created for legitimate work: authenticated sessions, helpdesk processes, administrative credentials, supplier access, remote support and familiar internal connections. The account may be valid, the route may be approved and the system may still be available, even though the behaviour has become unsafe.

Once that happens, the investment question changes. Your teams no longer need another description of the perimeter; they need a defined way to interrupt progression without disconnecting every service that still supports the business. That is an executable-control requirement, not another monitoring requirement.

Containment becomes easier to evaluate when the request describes a business capability rather than another product category. The conversation can move from tool count to the action your current portfolio can take during an active incident.

Our platform operates in the active middle, after prevention has been bypassed and before recovery becomes the dominant business project. It does not replace prevention, EDR, SIEM, identity controls, incident response or recovery. Nor is it another monitoring layer that merely describes the problem.

Ransomware Containment is our core platform. Server Intrusion Protection and Virtual Server Protection are additional features that operate on that platform, extending containment across server-side activity and virtual infrastructure.

Our platform provides defined containment actions that can interrupt ransomware encryption, constrain unsafe server-side activity and protect virtual environments. By reducing opportunities for lateral movement and data theft while investigation and recovery decisions continue, it helps prevent an initial compromise from becoming a wider and more disruptive security breach.

A separate budget line is justified by that operational difference. The investment buys the ability to change the trajectory after entry, while meaningful scope can still be kept outside the recovery problem.

If prevention is bypassed tomorrow, what funded capability can reduce the spread before recovery begins?

The answer should identify which malicious paths can be interrupted, which servers and virtual environments can be protected, which actions can be taken without disconnecting everything, which essential processes can continue and who can authorise those moves before the full forensic picture is available.

If those answers depend on improvised workarounds, your budget may still be weighted towards the before and after of an incident while underfunding the interval that determines how far the breach spreads.

Our next publication, "When Prepared Does Not Mean Ready", examines what happens after the budget, plans and roles appear to be in place. Readiness is proven only when a credible signal can trigger an authorised, bounded and explainable action before certainty arrives.