SIOS Technology has published its 2026 State of Application Resilience Survey, and the headline finding is uncomfortable. The survey polled more than 250 IT leaders. Seventy-six percent said their most critical application went down for more than ten minutes at least once last year. Every one of them had high availability and disaster recovery protection already in place. Application resilience, it turns out, is not the same thing as a HA/DR line item.
The survey that started this
SIOS is a vendor, so its survey needs handling with care. The sample is respectable: more than 250 IT leaders across North America and the UK, mostly large enterprises in healthcare, financial services, manufacturing, retail, government and technology.
The findings are specific. Only about half were satisfied with their HA/DR solutions, and more than a third were neutral. Only 7% tested disaster recovery monthly. Thirty-two percent tested annually, and 22% did not know how often testing happened at all. Nearly seven in ten ran critical applications across hybrid infrastructure, and only 2% were entirely on-premises.
Independent research says the same thing
That pattern is not a vendor artefact. Uptime Institute’s Annual Outage Analysis 2026 found outage frequency per site falling for a fifth year, but the improvement slowing. Around one in ten described their last outage as serious or severe. Fifty-seven percent said their most recent major outage cost more than $100,000, and one in five put it above $1 million for the second year running.
Forrester’s State of Disaster Recovery Preparedness 2026 found fewer than 40% felt very or extremely prepared for a site failure. Only 40% performed a partial or full failover at least annually. Twenty-seven percent did not failover and had no intention to. Only 32% had a dashboard showing recovery readiness.
Other surveys land in the same place. Quest Software found more than 75% of organisations do not test disaster recovery within the recommended six months, and 24% never test it. Keepit found 94% confident their plans covered agentic AI, against 32% testing monthly. Arcserve found 65% confident of recovering from ransomware within 48 hours, while only 35% had actually met their recovery targets in a full test.
Application resilience is a measured state
The recurring shape across all of it is a gap between confidence and capability. Organisations believe they are prepared. A minority can prove it.
That distinction changes what to buy. A recovery plan is a hypothesis until someone rehearses it. The binder says four hours; the restore takes three days, because a dependency moved, a credential expired, or the backup was never tested against a clean rebuild.
Recovery fails at the joins, not in the data
The cloud incidents of the past year show the mechanism. In October 2025, a latent race condition in AWS DynamoDB’s DNS automation emptied a regional endpoint in us-east-1. DynamoDB itself was impaired for about three hours. Broad recovery took around fifteen hours, because EC2’s host-management system lost its leases and fell into what AWS called congestive collapse.
Azure had its own run of incidents. A Front Door configuration change hit in October 2025. A Managed Identities failure lasted over ten hours in February 2026. Then came a power and cooling event in West US. A twenty-two-hour West US 2 outage followed in May 2026, after a thunderstorm tripped cooling systems into lockout.
The lesson repeats. Multi-zone is not disaster recovery. In September 2026, physical damage in AWS’s Bahrain region spanned multiple availability zones and destroyed customer data permanently, including for some workloads that were multi-AZ within that region.
Cyber resilience rewrote the problem
Ransomware changed the recovery assumption. Traditional disaster recovery trusts the last good backup. A ransomware event does not allow that, because attackers now target the recovery chain before the ransom note lands: backup consoles, administrator credentials, repositories and snapshots.
The numbers bear it out. Veeam’s 2025 ransomware research found 89% of backup repositories were targeted, and only 32% were immutable. Arcserve found just under half of organisations had deployed immutable backup storage, while more than half had already experienced ransomware.
The controls that follow are architectural, not procedural. NIST’s ransomware profile, updated in June 2026, and CISA guidance both point at offline or isolated copies and restore tests that produce evidence. Practitioners add two harder rules. Isolate the management plane, so protected copies cannot be reached even by a compromised administrator. And make sure the backup console does not depend on the identity system you are trying to restore.
Regulation now sets the numbers
Regulators have stopped treating this as a preference. Europe’s DORA has required annual ICT recovery testing for financial entities since January 2025, and NIS2 mandates business continuity and recovery measures.
India is more prescriptive. The RBI’s Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026 cover commercial banks, NBFCs, payment banks and all-India financial institutions. They require DR drills for critical systems at least half-yearly. The bank must sustain switchover to the DR site for at least a full working day. The recovery point objective for critical systems must be near zero.
SEBI’s cyber resilience framework is tighter still: a two-hour recovery time objective and a fifteen-minute recovery point objective, with the incident declared a disaster within thirty minutes.
Those numbers are floors, not proofs. A mandated RTO of two hours says what the regulator expects. It does not say the organisation can hit it.
The market is growing regardless
Spending keeps rising anyway. Estimates of the high availability and disaster recovery market range from about $22bn to $35bn for 2025, with forecasts to the low tens of billions by the early 2030s. Analysts put the business continuity market at roughly $56bn for 2026. Disaster recovery as a service is the largest HA/DR solution segment, at around 48%.
That growth is the point. The gap is not a shortage of tooling, since every survey here found organisations that had already bought. What is missing is evidence.
What to watch
Three signals. Whether recovery readiness becomes a measured metric rather than an assumed state, since fewer than a third of organisations currently have a dashboard for it. Whether the convergence of cyber and availability continues, because ransomware makes the two inseparable. And whether regulation keeps converting resilience from a project into an audited obligation, as the RBI and SEBI directions already have.
SIOS’s own answer is an application-aware one: monitor the application, not just the infrastructure beneath it. The survey data suggests the more urgent question is simpler. When did you last restore, and how long did it actually take?
Editor’s Note
This analysis draws on SIOS Technology‘s 2026 State of Application Resilience Survey, Uptime Institute’s Annual Outage Analysis 2026, Forrester’s State of Disaster Recovery Preparedness 2026, surveys from Quest Software, Arcserve and Keepit, Veeam’s ransomware research, published post-incident reviews from AWS and Microsoft Azure, NIST and CISA ransomware guidance, and regulatory directions from the Reserve Bank of India and SEBI. Where a figure or claim is a company’s own, we say so.