Data cyber resilience in the multicloud era

Informatec Digital » Resources » Data cyber resilience in the multicloud era

Cyberattacks , ransomware, data breaches, and business disruptions have become a constant source of anxiety for many security professionals . We're not just talking about a technical problem: a serious incident can cripple operations, ruin reputations, and wreak havoc on the bottom line of any organization.

At the same time, technology has become incredibly complex: hybrid environments, multicloud strategies , legacy systems, devices everywhere , and applications appearing without any oversight. This cocktail makes it difficult to clearly see where data is located, how it is protected, and what can be recovered if something goes wrong. It is in this context that data cyber resilience in the multicloud era ceases to be a trendy concept and becomes a strategic requirement for survival.

What exactly is data cyber resilience?

When we talk about cyber data resilience, we're referring to an organization's ability to withstand, respond to, and recover from attacks, failures, and security breaches while maintaining operations. It's not just about preventing incidents, but about ensuring that even in the event of ransomware, human error, or a physical disaster, the company can continue functioning with minimal loss of information, time, and money.

This vision goes beyond the traditional cybersecurity approach based solely on prevention, perimeter security, and antivirus . Cyber ​​resilience incorporates the concept of continuity: early detection, secure and immutable backups , well-rehearsed recovery plans, clear metrics of potential loss (RPO) and recovery time (RTO), and data governance aligned with regulations such as GDPR, NIS2, and other industry-specific regulations.

Key advantages of developing this capability include: reducing the economic impact of incidents, ensuring continued service delivery, minimizing exploitable vulnerabilities, and having trained employees who can respond effectively to each type of cyberattack. In regulated sectors or those with critical infrastructure, this resilience is not optional.

Market data reinforces this need: it is estimated that the economic damage from cyberattacks in 2025 will triple the amount accumulated in the previous decade , exceeding ten trillion dollars. And around 20% of that cost will be related to some type of ransomware, a type of attack that strikes at the heart of data resilience.

Why does the multicloud era complicate data protection so much?

Most organizations have already adopted a multicloud or hybrid strategy : combining public cloud from various providers, private cloud, their own data centers, and, of course, a significant amount of legacy systems. Recent studies indicate that around 72% of companies use multiple cloud providers , compared to just over half a few years ago.

This model offers flexibility, redundancy, and the ability to choose the best of both worlds, but it also presents significant challenges. Data ends up scattered across multiple platforms , with different management tools, heterogeneous security policies, and varying service levels between providers. Added to this is the explosion of SaaS applications, Kubernetes , containers, edge data, and endpoints that carry critical information outside the traditional perimeter.

The consequence is a dramatic increase in operational complexity : more consoles, more silos, more rules to maintain consistency. If each cloud is protected with a different solution and there is no centralized view, security gaps are created and the risk of misconfiguration—a classic cause of cloud incidents—skyrockets.

Furthermore, the shared responsibility model of the public cloud is frequently misunderstood. Hyperscalers protect the underlying infrastructure (hardware, network, some of the core software), but the organization remains responsible for the confidentiality, integrity, and availability of its data , as well as the secure configuration of services, identities, and access.

The numbers speak for themselves: around 70% of organizations hosting data or workloads in public clouds have experienced security incidents , and those operating with multiple clouds report up to twice as many incidents as those limited to a single platform. Protecting data in the multicloud era therefore means accepting that the attack surface is larger and that the security strategy must be much more coordinated.

Main challenges of cyber data resilience in multicloud

The first major obstacle is the lack of overall visibility . Many companies have backups in each cloud, specific on-premises tools, and different endpoint solutions, but they struggle to answer a simple question: where exactly is my critical data located, and what level of protection does each environment have?

Executives from companies in sectors as diverse as finance, retail, rail transport, and environmental services all agree on one thing: the obsession is having clear metrics that indicate how long it would take to recover from an attack and what real impact it would have on the business. The fragmentation of tools makes it nearly impossible to achieve a 360-degree view of risks without consolidating management practices.

Added to this is the shortage of cybersecurity specialists . Nearly half of organizations admit to having a significant talent gap in this field, especially in areas such as cloud protection, incident response, and security automation. This shortage complicates the operation of secure multicloud environments and increases reliance on external providers and managed services.

The second major challenge lies in legacy data protection strategies : backup solutions designed for a single data center, slow restores, a lack of immutable or air-gapped backups, and manual processes that don't scale in a distributed world. These traditional architectures don't guarantee business survival in the face of a massive attack because they aren't designed to respond quickly or integrate cybersecurity signals.

Finally, the regulatory and legal impact must be considered. Organizations that handle particularly sensitive data (for example, animal medical records considered equivalent to personal data, customer financial information, or systems classified as critical infrastructure) face laws that require them to report breaches within specific timeframes and demonstrate that appropriate protective measures have been taken.

Key strategies for building cyber resilience in multicloud environments

To advance toward true data cyber resilience in the multicloud era, it is necessary to orchestrate various elements: technology, processes, people, and governance . Simply adding another tool is not enough; the approach must be rethought from the perspective of business continuity and the value of data.

Assess the current level of data resilience

The starting point is to conduct a comprehensive risk and capability assessment. This involves identifying the most likely threats (ransomware, hardware failures, natural disasters, misconfigurations, malicious insiders), their potential impact on the business, and how data is currently protected against each of them.

It is essential to critically review backup and recovery processes : backup frequency, storage location, immutability, restoration times achieved in real-world testing, and whether all workloads are covered (on-premises, public clouds, SaaS, endpoints, OT environments, etc.). Many organizations discover in this analysis that a significant portion of their data is not being adequately backed up.

Another key element is data management and governance . Clear policies must be in place for information classification, encryption, access control, segregation of duties, and regulatory compliance. Without this framework, it is very difficult to prioritize what to recover first and what level of protection to apply to each type of data.

Finally, disaster recovery plans should be tested through regular drills involving all relevant departments. Simply having a document is not enough: it's essential to verify that procedures work, response times are reasonable, and everyone knows what to do when an alarm is raised.

Essential metrics: RPO, RTO and data integrity

To measure cyber resilience, it's essential to work with some basic indicators. The Recovery Point Objective (RPO) defines how much data loss is acceptable, measured in time (last hour, last five minutes, last day, etc.). The lower the RPO, the less impact an incident will have in terms of data loss.

The Recovery Time Objective (RTO) indicates the maximum amount of time it can take to restore systems and services to an acceptable operational state. A short RTO requires highly optimized architectures and processes, but it makes the difference between a minor setback and a reputational disaster.

Data integrity is another key pillar: ensuring that information is not corrupted, manipulated, or deleted without control throughout its lifecycle. This involves having verification mechanisms, online corruption detection, robust access controls, audit logs, and copies that can be proven to be intact in an investigation or by a regulator.

Furthermore, the existence of redundant infrastructure , such as multiple data centers, backups in different regions or clouds, and failover capabilities, improves availability and reduces the likelihood of a single point of failure. In multicloud environments, intelligently distributing workloads and data across providers allows for better absorption of partial outages.

Security best practices in multicloud strategies

In a multi-cloud environment, one of the fundamental principles is understanding and properly leveraging the shared responsibility model . While the provider protects its infrastructure, the organization must decide how it encrypts data, who has access, how users are authenticated, and where keys are stored.

It is highly recommended that security policies and configurations be applied consistently across all clouds: the same encryption standards, uniform identity and access management criteria, multi-factor authentication, network segmentation, and centralized monitoring. Inconsistency is a major source of vulnerabilities.

Automating security tasks (patching, deploying secure configurations, managing certificates, initial incident response) helps reduce human error and accelerates response to threats. The less critical processes depend on manual actions, the stronger the resilience.

Another common mistake is overusing isolated , piecemeal solutions that only address part of the problem, leading to administrative overload and security vulnerabilities. In multicloud environments, it's preferable to invest in platforms capable of orchestrating end-to-end data protection and recovery, combining visibility with business context.

In this regard, having unified administration and a central security team that coordinates policies, tools, and incident response across all clouds is an increasingly common practice. This team must have access to telemetry and logs from all platforms to detect anomalous patterns and correlate events.

Technological solutions and approaches for data cyber resilience

A wide range of backup, archiving, disaster recovery, and cyber resilience solutions designed for the multicloud era are already available on the market. While each provider has its own approach, they share some key principles: centralization, automation, intensive use of the cloud, and strong integration with security capabilities.

For example, some SaaS backup platforms offer 100% cloud-based protection, eliminating the need for physical infrastructure . This model avoids the need to maintain on-premises hardware, simplifies upgrades, and leverages the scale and availability of major cloud providers. These solutions typically cover everything from cloud data, SaaS applications, and servers to traditional data centers and endpoints.

Other proposals, such as cyber resilience suites from infrastructure manufacturers, combine storage appliances, data protection software, and cyber recovery solutions to create air-gapped vaults for the most critical data. Artificial intelligence and machine learning analytics techniques are then applied to these repositories to identify anomalous patterns that may indicate an ongoing attack.

In the area of ​​storage, advanced systems such as certain families of enterprise flash storage arrays integrate online data corruption detection, automated backups, frequent snapshots, and simplified recovery paths. All of this aims to shorten RPO and RTO while incorporating native cyber resilience capabilities.

Backup and recovery services "as a Service" are also gaining traction , allowing companies to consume data protection elastically, paying only for the volume actually used, without having to size and maintain internal infrastructure. This model is especially attractive for organizations with small IT teams or those geographically dispersed.

Encryption and key management in multicloud environments

Encryption has become one of the most widely used tools for protecting confidential information in the cloud. More than half of IT professionals cite encryption and key management as the technologies they use to safeguard sensitive data in cloud environments.

However, significant challenges arise related to the scale, availability, portability, and heterogeneity of each provider's cryptographic services. Managing each cloud separately risks becoming "tied" to a single vendor, losing visibility into who uses which key, and greatly complicating audits and incident response.

A more mature approach involves adopting a data-centric security model , selecting solutions that can be consistently applied to workloads hosted in any cloud or on-premises, without needing to rewrite applications or change cryptographic mechanisms depending on the destination.

It is also critical to ensure complete control over the entire key lifecycle : how they are generated, where they are stored, who can access them, which services they are used in, and what happens when they need to be rotated or revoked. Without this visibility, it is nearly impossible to demonstrate compliance or respond quickly to a data breach.

Finally, cryptographic services must be highly available . If the key management system or encryption service fails, access to critical applications can be blocked. Therefore, it is preferable to avoid overly dispersed architectures and seek solutions designed to withstand network outages and component failures without causing inconsistent data or prolonged interruptions.

Zero Trust, continuous monitoring and AI applied to data protection

Adopting a Zero Trust approach is becoming a central component of data cyber resilience strategies. Instead of relying on the perimeter, the premise is that no identity, device, or service can be trusted by default, whether inside or outside the corporate network.

In practice, this translates to mandatory multi-factor authentication, least privilege, advanced segmentation , continuous monitoring of device security posture, and strong control over access to data and backup systems. This model minimizes the opportunities for an attacker to move laterally and access backup repositories, which are typically their primary target.

Constant monitoring and real-time analysis are essential to detect unusual behavior before it escalates. Modern solutions integrate early ransomware detection mechanisms, analysis of anomalies in backup patterns (e.g., sudden changes in compression rates or write volumes), and alerts for potential data corruption.

Artificial intelligence and machine learning also help prioritize alerts, reduce false positives, and automate initial responses . For example, when an attack is suspected, some platforms can automatically block certain accounts, isolate compromised systems, and initiate data restorations from immutable backups, drastically reducing the impact.

Complementing these technologies, specialized cyber recovery services offer secure procedures and environments to restore information to "clean" states, verify its integrity before reintroducing it into production, and meet recovery deadlines required by regulations or agreements with clients.

People, culture and managed services: the human side of cyber resilience

However sophisticated the technology, data cyber resilience still depends heavily on people . Many attacks begin with a simple phishing email, a malicious link, or a well-designed identity theft, and the best defense in these cases is an informed and trained user.

Hence the importance of continuous investment in training and awareness programs tailored to the type of organization and the real risks it faces. Phishing drills, internal campaigns, specific sessions for middle and senior management… all help create a culture where security is everyone's responsibility.

At the same time, concerns are growing about third-party and supplier access to corporate information. It's common for suppliers to subcontract certain services, making it more difficult to know who actually has access to the data. For this reason, many cybersecurity committees include legal and internal control experts, and partners are required to demonstrate their security and compliance measures.

In a context where experts are scarce, an increasingly common option is to transfer part of the risk to specialized companies through managed security and operations services (MSSP, SOC-as-a-Service, backup management, etc.). However, it is essential that these providers offer complete system administration, 24/7 monitoring, both remote and on-site incident management, and the generation of clear reports with continuous improvement proposals.

One of the classic mistakes is failing to recognize the importance of information security management until a serious incident has already occurred. The organizations that best withstand an attack are precisely those that planned ahead, documented their decisions, and aligned their cybersecurity strategy with business objectives, rather than treating it as an isolated IT expense.

Given the current threat landscape, the shortage of skilled professionals, the explosion of data, and the increasing complexity of multicloud environments, it's clear that data cyber resilience has become a strategic pillar for any company that wants to remain competitive. Integrating data-driven protection, detection, response, and recovery, leveraging modern platforms, automation, and AI, and strengthening security culture and collaboration with expert partners will make the difference between organizations that merely survive incidents and those that are able to continue operating, learning, and improving after each crisis.