--- title: Blog date: 2026-04-10T10:48:00+02:00 canonical_url: "https://www.fast-lta.de/en/blog" section: "Page: Blog" --- Latest article # Shadow AI in the workplace Shadow AI in organizations: data leakage, hallucination, bias, copyright. How CISOs spot the risks and provide a secure alternative with local AI. [Read article ](https://www.fast-lta.de/en/blog/schatten-ki-im-unternehmen "Shadow AI in the workplace") [![E42796c6c46c8138f9f700b90cbb9964 MD5 | FAST LTA](https://fast-lta.transforms.svdcdn.com/production/images/blog/e42796c6c46c8138f9f700b90cbb9964_MD5.jpg?w=960&q=80&fm=webp&fit=crop&dm=1776231152&s=7b9b019e492ba0dfd1755430f32cb915)](https://www.fast-lta.de/en/blog/schatten-ki-im-unternehmen) ###### Filter [All ](?s=&q=19048)[Article ](?t=10117&s=&q=19048)[Blog Post ](?t=19513&s=&q=19048) ###### Topics [All ](?s=&t=)[AI Knowledge Management ](?q=31560&s=&t=)[Compliance ](?q=35447&s=&t=)[Data sovereignty ](?q=19043&s=&t=)[IT resilience ](?q=19045&s=&t=)[Ransomware protection ](?q=19048&s=&t=) ###### Search Blog Post [IT resilience ](https://www.fast-lta.de/en/blog/it-resilience)[Ransomware protection ](https://www.fast-lta.de/en/blog/ransomware-protection) [#### Disaster Recovery Test: How to Test Your DR Plan A DR plan that has never been tested is fiction. This is not an overreaction. It is IT reality. Backups that have not been tested often cannot be restored. Recovery runbooks that have never been rehearsed contain countless errors. RTOs that have never been measured are guesswork.The good news: regular DR tests are not impossible. There are three practical methods, varying in effort and depth.--- ](https://www.fast-lta.de/en/blog/disaster-recovery-test-so-testen-sie-ihren-dr-plan) [Lesen ](https://www.fast-lta.de/en/blog/disaster-recovery-test-so-testen-sie-ihren-dr-plan "Disaster Recovery Test: How to Test Your DR Plan") Blog Post [IT resilience ](https://www.fast-lta.de/en/blog/it-resilience)[Ransomware protection ](https://www.fast-lta.de/en/blog/ransomware-protection) [#### Defining RTO and RPO Correctly: A Practical Guide RTO (Recovery Time Objective) and RPO (Recovery Point Objective) are the most critical metrics in any resilience strategy. They answer two questions:- **RTO:** How long can my system be down? - **RPO:** How much data loss can I tolerate?The problem: many organizations "estimate" RTO/RPO based on gut feeling or IT tradition. That is the wrong approach. RTO/RPO must be derived from a **Business Impact Analysis (BIA)**, not the other way around. The BIA-first approach is also what the relevant standards expect: ISO 22301 builds the entire BCM system on it, and NIS2 (Directive (EU) 2022/2555) requires risk-based backup management and disaster recovery.--- ](https://www.fast-lta.de/en/blog/rto-und-rpo-richtig-definieren-praxisanleitung) [Lesen ](https://www.fast-lta.de/en/blog/rto-und-rpo-richtig-definieren-praxisanleitung "Defining RTO and RPO Correctly: A Practical Guide") Blog Post [IT resilience ](https://www.fast-lta.de/en/blog/it-resilience)[Ransomware protection ](https://www.fast-lta.de/en/blog/ransomware-protection) [#### Recovery Time Objective: How to Calculate Your RTO Realistically RTO is one of the most important concepts in backup and disaster recovery management. But most organisations get it wrong. They say "our RTO is 4 hours," then when an attack hits, recovery takes 2 days. This article explains how to calculate RTO realistically and, more importantly, how to test it.--- ](https://www.fast-lta.de/en/blog/recovery-time-objective-so-berechnen-sie-ihr-rto-realistisch) [Lesen ](https://www.fast-lta.de/en/blog/recovery-time-objective-so-berechnen-sie-ihr-rto-realistisch "Recovery Time Objective: How to Calculate Your RTO Realistically") Blog Post [IT resilience ](https://www.fast-lta.de/en/blog/it-resilience)[Ransomware protection ](https://www.fast-lta.de/en/blog/ransomware-protection) [#### Recovery Runbook: What Goes in It and Who Maintains It A recovery runbook is not an IT philosophy. It is an operational handbook. It is the document your IT team reaches for during an actual disaster and uses to work through, step by step, how to bring systems back up.A good runbook is specific enough that someone who does not normally maintain the system could still restore it. That is the quality benchmark.--- ](https://www.fast-lta.de/en/blog/recovery-runbook-was-hineingeh%C3%B6rt-und-wer-es-pflegt) [Lesen ](https://www.fast-lta.de/en/blog/recovery-runbook-was-hineingeh%C3%B6rt-und-wer-es-pflegt "Recovery Runbook: What Goes in It and Who Maintains It") Blog Post [IT resilience ](https://www.fast-lta.de/en/blog/it-resilience)[Ransomware protection ](https://www.fast-lta.de/en/blog/ransomware-protection) [#### Isolated Recovery Environment: Building a Protected Recovery Zone An Isolated Recovery Environment (IRE), sometimes called a cleanroom, is not a single device. It is an infrastructure zone that is completely isolated from the production network. It is the place where you restore, verify, and clean compromised systems before returning them to production.Without an IRE, recovery in a compromised network is a gamble: the restored server gets reinfected before you can use it.--- ](https://www.fast-lta.de/en/blog/isolated-recovery-environment-aufbau-einer-gesch%C3%BCtzten-recovery-zone) [Lesen ](https://www.fast-lta.de/en/blog/isolated-recovery-environment-aufbau-einer-gesch%C3%BCtzten-recovery-zone "Isolated Recovery Environment: Building a Protected Recovery Zone") Blog Post [IT resilience ](https://www.fast-lta.de/en/blog/it-resilience)[Ransomware protection ](https://www.fast-lta.de/en/blog/ransomware-protection) [#### Assume Breach: The Design Principle That Changes Your Architecture "Assume Breach" is not just a security slogan. It is a fundamental design principle that reshapes the entire architecture of an organization. Think it through consistently, and you have to rebuild parts of your IT.The concept is simple: **not if, but when will your organization be attacked and compromised?**This is not pessimism. The data is unambiguous: in the Veeam Ransomware Trends Report 2025, roughly 7 in 10 organizations reported at least one ransomware attack in the preceding year, despite improved defenses. For exposed industries (financial services, healthcare, manufacturing), the question is realistically only: when?--- ](https://www.fast-lta.de/en/blog/assume-breach-das-designprinzip-das-ihre-architektur-ver%C3%A4ndert) [Lesen ](https://www.fast-lta.de/en/blog/assume-breach-das-designprinzip-das-ihre-architektur-ver%C3%A4ndert "Assume Breach: The Design Principle That Changes Your Architecture") Blog Post [Compliance ](https://www.fast-lta.de/en/blog/compliance)[Ransomware protection ](https://www.fast-lta.de/en/blog/ransomware-protection) [#### Air Gap as a Resilience Layer: Why Tier 2 Decides Everything A common strategy is: "We have online backups (Tier 1) and cloud copies (Tier 4). That is enough." This is a critical mistake that sets you up to fail against ransomware attacks.Why? Because both Tier 1 and Tier 4 are network-connected. An attacker with sufficient access can compromise both.Tier 2 (air gap) is the only layer protected by physical isolation.--- ](https://www.fast-lta.de/en/blog/air-gap-als-resilienz-layer-warum-tier-2-%C3%BCber-alles-entscheidet) [Lesen ](https://www.fast-lta.de/en/blog/air-gap-als-resilienz-layer-warum-tier-2-%C3%BCber-alles-entscheidet "Air Gap as a Resilience Layer: Why Tier 2 Decides Everything") Blog Post [Compliance ](https://www.fast-lta.de/en/blog/compliance)[Ransomware protection ](https://www.fast-lta.de/en/blog/ransomware-protection) [#### Backup Media Compared: Ransomware Resilience There are many ways to back up data. But not all protect equally well against ransomware. A NAS backup is not the same as a tape backup or a cloud backup, and none of them behaves like an air-gapped disk system. This article compares the most common secondary storage options and evaluates their suitability against ransomware. The benchmark matters: according to the Veeam Ransomware Trends Report 2025, 89 percent of ransomware attacks targeted backup repositories.--- ](https://www.fast-lta.de/en/blog/backup-medien-im-ransomware-vergleich) [Lesen ](https://www.fast-lta.de/en/blog/backup-medien-im-ransomware-vergleich "Backup Media Compared: Ransomware Resilience") Blog Post [Compliance ](https://www.fast-lta.de/en/blog/compliance)[Ransomware protection ](https://www.fast-lta.de/en/blog/ransomware-protection) [#### Tabletop Exercise Ransomware: Instructions and Scenarios A tabletop exercise is a crisis simulation at the conference table: no real attack, no real systems, but real decisions, real communication chains, and real gaps that surface.For ransomware scenarios, the tabletop exercise is particularly valuable because it forces exactly the questions that must be answered under time pressure during an actual incident: Who decides whether to pay a ransom? How do we report the incident to the competent authority within the NIS2 deadlines? How do we recover if the DR plan folder is also encrypted?This guide covers preparation and facilitation, including three complete scenarios with discussion questions and an evaluation framework.**Reading time:** approx. 13 minutes | **Updated:** May 2026--- ](https://www.fast-lta.de/en/blog/tabletop-exercise-ransomware-2) [Lesen ](https://www.fast-lta.de/en/blog/tabletop-exercise-ransomware-2 "Tabletop Exercise Ransomware: Instructions and Scenarios") Blog Post [Compliance ](https://www.fast-lta.de/en/blog/compliance)[Ransomware protection ](https://www.fast-lta.de/en/blog/ransomware-protection) [#### Incident Response for Ransomware: Who Does What? A ransomware attack is not an IT problem alone. It affects management, legal, communications, and insurance. Without clear role assignments, chaos ensues. A well-structured Incident Response (IR) team with rehearsed processes shortens decision paths and measurably reduces downtime and damage.This article presents the IR team structure, external resources, and the EU reporting deadlines you must hit.--- ](https://www.fast-lta.de/en/blog/incident-response-bei-ransomware-wer-macht-was) [Lesen ](https://www.fast-lta.de/en/blog/incident-response-bei-ransomware-wer-macht-was "Incident Response for Ransomware: Who Does What?") Blog Post [Compliance ](https://www.fast-lta.de/en/blog/compliance)[Ransomware protection ](https://www.fast-lta.de/en/blog/ransomware-protection) [#### Ransomware Recovery Checklist: 12 Steps After an Attack Ransomware has hit. Your systems are offline. What now? Panic is the first instinct, but not the right response. A proven, documented checklist can reduce downtime from weeks to days.This checklist is divided into four phases: Isolation (0 to 4 hours), Recovery Start (4 to 24 hours), Full Restoration (days 2 to 7), Post-Incident Review (afterwards).--- ](https://www.fast-lta.de/en/blog/ransomware-recovery-checkliste-12-schritte-nach-dem-angriff) [Lesen ](https://www.fast-lta.de/en/blog/ransomware-recovery-checkliste-12-schritte-nach-dem-angriff "Ransomware Recovery Checklist: 12 Steps After an Attack") Blog Post [Compliance ](https://www.fast-lta.de/en/blog/compliance)[Ransomware protection ](https://www.fast-lta.de/en/blog/ransomware-protection) [#### How Ransomware Destroys Backups: A Technical Analysis A backup is only as secure as it is difficult to reach and delete. Most organisations store their backups on network shares or cloud storage, both of which are reachable by ransomware. Modern ransomware variants are not naive: they actively search for backups and destroy them before you realise you have been hit. The Veeam Ransomware Trends Report 2025 found that 89 percent of ransomware attacks targeted backup repositories.For IT decision-makers, this understanding is critical: a backup is only a backup if ransomware cannot delete it. This article explains the four main tactics ransomware uses to destroy your backup copies, and how a hardware air gap provides real protection.--- ](https://www.fast-lta.de/en/blog/wie-ransomware-backups-zerst%C3%B6rt-technische-analyse) [Lesen ](https://www.fast-lta.de/en/blog/wie-ransomware-backups-zerst%C3%B6rt-technische-analyse "How Ransomware Destroys Backups: A Technical Analysis") load more