Reduce Costs and Achieve Better Outcomes
Recovery infrastructure spending has never been higher. Yet for most organizations, it is hard to point to any metrics that show improvement in recovery operations. Restorations take longer. Incidents are harder to recover from. And the financial impact of downtime keeps climbing.
That gap between investment and outcome is the central finding of a new research paper from S&P Global 451 Research, commissioned by Broadcom: Modernizing Recovery, Strategic Recommendations for Managing Risk and Cost. The paper diagnoses why legacy recovery options are falling short — and lays out what modern recovery actually requires.
Recovery Investment Is Growing — So Why Aren’t Outcomes Improving?
The nature of backup and recovery operations has changed significantly in recent years. Previously, backups were used mostly for operational and disaster recovery; a disk fails, an end user deletes a file, a disaster strikes. Traditional backup and recovery solutions excelled at protecting data inexpensively and restoring it in a reasonable amount of time.
The threat landscape has since evolved and intensified. Security incidents are now the leading cause of outages, and threat evolution is now accelerating due to AI. Newer workloads, particularly AI, drive ever-increasing volumes of data that need protection. In response, organizations have added capacity, policies, and tools to their recovery environments. Yet the results tell a different story:
- The mean cost of a single outage exceeds $2 million. 35% of outages cost more than $1 million. 3% exceed $10 million1.
- Recovery effort is increasing, not decreasing. 35% of organizations say it takes significant effort to synchronize and restore primary systems after a storage failure, up from 27% just one year prior [2]. Another 45% say it takes moderate effort1.
- Security incidents are now the leading cause of outages. 23% of respondents cite a security issue as the cause of their most recent outage, ahead of software failures at 22%1.
The root cause isn’t a lack of investment; it’s a mismatch between what legacy architectures were built to do and what today’s environment demands of them. The S&P Global / 451 Research paper identifies four specific areas where that mismatch is most acute, and where modernization delivers the clearest returns.
Four Challenges Where Legacy Recovery Falls Short
Challenge 1: The Cost of Recovery Infrastructure
While legacy recovery solutions were designed to store data inexpensively, the sheer volume of data growth, nearly 30% annually1, when combined with rising cost of storage is making the cost of backup and recovery infrastructure a significant challenge for IT. While buyers have leaned toward appliance-based solutions historically, these come at a significant price premium over more industry-standard solutions, driving up the capital cost of recovery infrastructure further.
Challenge 2: Speed of Recovery
Modern applications, compliance requirements, and business operations have zero tolerance for slow recovery. Yet most organizations still rely on backup architectures designed for a different era, built around spinning disk and flat retention policies that were never optimized for fast restoration.
The numbers show the impact. More than 80% of organizations report moderate to significant effort in restoring primary systems after a failure1. That effort translates directly to extended downtime, elevated costs, and eroded business confidence in the recovery infrastructure they’ve invested in. The mean cost of a single outage now exceeds $2 million, driven in part by the length of downtime.
Challenge 3: Operational Complexity of Recovery
Recovery operations have grown in scope and complexity faster than most teams or architectures have adapted. Organizations must now protect workloads across diverse storage environments, manage sophisticated retention policies, and coordinate recovery across infrastructure, security, and application teams — all while supporting faster and more aggressive recovery objectives.
Most legacy architectures push that complexity onto people. The result is manual, error-prone processes that slow recovery and introduce risk, especially as data volumes and recovery requirements keep growing. AI accelerates this dynamic further:
- It increases raw data volumes that must be protected
- It strains infrastructure budgets
- It demands faster data access, making slow recovery storage media impractical
Challenge 4: Recovery from Cyber Attacks
Security incidents are now the leading cause of outages, and they fundamentally change what recovery demands of your organization. When a ransomware or malware event strikes, restoring data is only part of the job. Your team must also:
- Confirm that backups are clean and free of malware before restoring
- Prevent reinfected workloads from re-entering production
- Coordinate in real time across security, infrastructure, and application teams
That cross-team coordination requirement is where most organizations hit a wall. Recovery can no longer belong to the backup team alone, yet most architectures and processes were built as if it could be.
What Modern Recovery Actually Requires
The 451 Research paper translates these trends into a set of concrete architectural requirements. Modern resiliency infrastructure needs to deliver:
| Capability | What It Enables |
|---|---|
| Lower cost recovery infrastructure with hybrid cloud tiering | Cost aligned to recovery priority, not storage volume |
| Flash-based recovery storage for warm data | Fast restores, high reliability, reduced footprint |
| Unified operational model across environments | Simplifies and accelerates incident response |
| Isolated clean room environments | Safe space to verify workloads before returning to production |
Modern Capability #1 – Lower Cost Recovery Infrastructure with Hybrid Cloud Tiering
Customers are increasingly looking for alternatives to purpose-built backup appliances, which can be expensive compared to the relative recovery performance they deliver. Commodity hardware and cloud-based approaches offer greater performance at a similar or lower cost: a classic optimization opportunity.
A hybrid cloud model supports this optimization. You keep recent backups and high-priority recovery data on fast local infrastructure, and move long-term retention to lower-cost cloud tiers, with a single operational model for simplicity. This aligns spending directly with recovery value: pay for speed where speed matters, pay for scale where scale matters.
Modern Capability #2 – Flash Based Recovery for Warm Data
Flash-based storage has changed the cost calculus. Compared to spinning disk, flash delivers lower failure rates, a smaller physical footprint, and meaningfully lower energy consumption. As the cost gap between flash and disk has narrowed, flash increasingly wins on total value when recovery speed and reliability are factored in, while lowering operational overhead in the process.
Modern Capability #3 – Unified Operational Model
A unified operational model across on-premises environments, cloud environments and storage use cases accelerates incident response. During a ransomware event, when speed and clarity are paramount, a unified hybrid architecture reduces manual effort, simplifies policy management and shortens the time needed to identify clean recovery points and initiate restoration workflows. Equally important, it enables backup, infrastructure and security teams to operate from a shared context during a crisis, rather than each team navigating its own tools and data views in parallel. The operational benefits of this integration are most visible precisely when organizations need them most.
Modern Capability #4 – Isolated Clean Room Environments
Organizations should consider new innovations such as prescriptive isolated clean rooms. The industry has delivered solutions that simplify the provisioning, managing and securing of these environments and end-to-end workflows that integrate all the critical components and steps of cyber recovery.
How VMware vSAN and Advanced Cyber Compliance Deliver on These Requirements
The capabilities described in the 451 Research paper map directly to what VMware Cloud Foundation (VCF) 9.1 delivers today. VMware vSAN Protection and Recovery, updated in VCF 9.1, and VMware Advanced Cyber Compliance, addresses each of the paper’s core requirements:
- Lower TCO – VCF customers can lower their recovery infrastructure costs by 27% compared to comparable all-flash alternatives2. VCF’s software-defined approach allows customers to deploy a disaster recovery or cyber recovery cluster on commodity hardware, reducing hardware costs. Cyber Recovery servers lower costs in part because they have lower CPU and memory requirements than standard vSAN HCI or storage cluster servers. They also can leverage QLC devices for greater consolidation and lower per GB costs.
- Rapid Recovery – All NVMe-based disaster recovery and cyber recovery clusters offer significant performance advantages over traditional disk-based systems, with greater drive endurance. In internal testing, vSAN-based infrastructure delivered among the best restore times of all-flash recovery offerings.
- Unified Operational Model – VMware uniquely offers the ability to deploy, scale and manage production, disaster recovery and cyber recovery storage infrastructure from the same UI, with guided workflows and a high degree of automation to accelerate operations. VMware Advanced Cyber Compliance integrates all of the capabilities needed to orchestrate, automate and streamline recovery operations across on-premises VCF sites at scale.
- On-premises Isolated Recovery Environment (IRE) with VMware Advanced Cyber Compliance (ACC) – Build a fully customer-owned and managed clean room with push-button isolation. No dependency on cloud-based recovery sites. Full integration with endpoint detection and response tools ensures workloads are verified clean before returning to production3.
The ACC advanced service directly addresses the cross-team coordination challenge the research highlights. Security and infrastructure teams operate from a shared, orchestrated recovery workflow, reducing reinfection risk and compressing recovery windows when it matters most.
For organizations that have already invested in VMware infrastructure, VCF 9.1 extends that investment to close the outcomes gap without requiring a platform replacement or a new vendor relationship.
Read the Full Research: Resiliency Modernization
The S&P Global 451 Research paper commissioned by Broadcom goes deeper on all of these trends, including full survey methodology, data breakdowns, and detailed architectural recommendations. If you’re building the case internally for a recovery modernization initiative, this paper gives you independent, third-party research to anchor the conversation.
To see how VMware vSAN and the Advanced Cyber Compliance advanced service implement these recommendations in VCF 9.1, read the blog.
Sources:
1. S&P Global 451 Research, “Modernizing Recovery, Strategic Recommendations for Managing Risk and Cost .” May 2026. Commissioned by Broadcom.
2. VMware internal analysis, May 2026.
3. VMware Cloud Foundation Blog, “VMware vSAN Protection and Recovery Enhancements for VCF 9.1,” May 2026.
Discover more from VMware Cloud Foundation (VCF) Blog
Subscribe to get the latest posts sent to your email.
