When ransomware hits, your recovery
environment is already compromised.
Ours isn't.
A pre-provisioned, IOC-validated Microsoft 365 recovery environment, activated automatically the moment ARRAC contains a threat. No consultants. No waiting. Recovery starts when containment ends.
Restoring into a compromised environment causes immediate reinfection.
Most organisations restore backups into the same Microsoft 365 tenant that was attacked: the same compromised admin accounts, the same OAuth applications with persistent access, the same Entra ID that the attacker already owns. The result is reinfection within hours.
- Production tenant compromised
- Restore backup into same tenant
- Attacker still has admin access via persisted OAuth app
- Reinfected within hours
- Start again. Incident cost doubles.
- Production tenant isolated by ARRAC
- ARRAC activates clean recovery tenant automatically
- IOC-validated restore, data scanned before cutover
- Identity rebuilt, enforced MFA reset, no attacker persistence
- Safe cutover when you're ready
Automated. Validated. Ready before you need it.
Recovery Assurance runs continuously in the background of your ARRAC subscription. When a ransomware incident occurs, it activates without a manual trigger, so your team can focus on the response, not the logistics.
A clean Microsoft 365 recovery tenant is provisioned for your organisation when you subscribe. Tested monthly. Validated against your current configuration. Ready and waiting.
The moment ARRAC detects and contains a ransomware threat, Recovery Assurance activates automatically. The clean environment is brought online while containment is still in progress.
Backups are restored into the clean tenant and scanned against ARRAC's live threat intelligence (ThreatFox, MalwareBazaar, OTX) before any data is declared clean and made available.
Identity is rebuilt with enforced MFA reset. Compromised credentials, OAuth apps, and admin accounts cannot follow you into the clean environment. You cut over when you're ready.
Everything needed to recover. Nothing that needs a consultant.
Every capability required to restore operations safely is included in the subscription: no professional services retainer, no emergency call-out fee.
A dedicated Microsoft 365 tenant provisioned exclusively for your organisation. Ready before any incident occurs.
The recovery environment is activated and validated every month. Proof it works before you need it to.
Every backup restored into the clean environment is scanned against ThreatFox, MalwareBazaar and OTX before cutover. Hash-based checks identify known malicious signatures. Post-recovery monitoring is recommended for 72 hours.
Admin accounts, OAuth applications, and Entra ID are rebuilt from scratch. Compromised credentials cannot persist into the clean environment.
Recovery Assurance is activated within four hours of containment. The clean environment is online before your team has finished briefing stakeholders.
Every step of the recovery process is logged with timestamps and actor context. Regulatory-ready documentation, generated automatically.
Less than one hour of incident response consultancy. Every month.
IR consultancy firms charge £2,000–£5,000 per hour during a ransomware incident. Recovery Assurance costs less than a single hour, already active before the call is made.
- Pre-provisioned Microsoft 365 recovery environment, ready to activate
- Monthly recovery simulation with full results report
- IOC validation on restored data (hash-based checks via ThreatFox, MalwareBazaar and OTX)
- Identity rebuild playbook for Entra ID and Exchange
- Two activations included per year
- Supported backup providers: Veeam, Datto, Acronis, Spanning and any solution with exportable M365 data
- Up to 150 users
- Everything in Tier 1
- ARRAC-managed Veeam Backup for Microsoft 365
- 1TB backup storage included. Additional storage available in 1TB increments; contact us for pricing.
- Cross-tenant restore capability
- Up to 150 users
Both packages include two recovery activations per year at no additional charge. Additional activations are charged at £995 per incident. Environments above 150 users or requiring more than 1TB of backup storage are priced individually. Contact us for a scoped quote.
| Tier 1 | Tier 2 | |
|---|---|---|
| Max users | 150 | 150 |
| Backup managed by | You | ARRAC |
| Backup storage | Your own | 1TB included |
| Additional storage | N/A | Per 1TB, contact us |
| Cross-tenant restore | No | Yes |
| Activations included/year | 2 | 2 |
| Additional activations | £995 each | £995 each |
| Monthly price | £697 | £997 |
IOC Validation
IOC validation uses hash-based threat intelligence to identify known malicious signatures in restored data. It does not guarantee detection of novel or unknown threats. ARRAC recommends post-recovery monitoring for a minimum of 72 hours.
Need more than 150 users or 1TB of storage?
Recovery complexity, backup licensing and storage requirements scale with your environment. Contact us for a scoped quote covering your protected user count, data volume and recovery SLA.
Contact us →What you need to know before you need it.
Cross-tenant recovery tested and verified. Not theoretical.
Numbers, scope, and constraints, stated plainly so there are no surprises during an incident.
Tenant readiness: <1 hour. Identity recovery and first-user access: <4 hours. Full workload restoration: 4–24 hours, depending on data volume.
Exchange mailboxes, OneDrive, SharePoint sites, and Teams: full restore or granular item-level recovery. Workloads outside this set are out of scope.
Hash-based checks against ThreatFox, OTX, and MalwareBazaar before any restore is declared clean. Does not detect novel or unknown threats. ARRAC recommends 72-hour post-recovery monitoring.
Executive summary plus technical appendix. Every report includes immutable timestamped evidence, admissible for insurance, compliance, and board review.
2 activations per year. 500 GB per activation. Overage is charged at cost. No penalty, no contract cliff. Additional activations available on request.
Recovery Assurance works because ARRAC does.
Recovery Assurance is not a standalone product. It is an add-on to the ARRAC platform, and its value comes from that tight integration: ARRAC detects the threat, contains it, and activates Recovery Assurance, all without a human trigger.
Recovery Assurance requires an active ARRAC platform subscription. If you don't have one yet, the fastest way to get started is a 14-day free trial. All 10 platform modules included, no credit card required. Recovery Assurance can be added at any point.
Start with the platform →