VMware by Broadcom · Software · YoctoIT tech page

Live Recovery

Protection and restore: orchestrated DR and ransomware recovery with isolated remediation environments.

FOCUS · RESTART, CLEANImmutable snapshots, a clean room and orchestrated failover: recovery designed for ransomware
Request the Free Assessment Learn more
YoctoIT material for clients and partners · VMware, vSphere, vSAN, NSX and the other products mentioned are trademarks of Broadcom Inc.
01 · What it is

Live Recovery, made clear.

Live Recovery unites the two trades of restarting: classic orchestrated DR (formerly SRM: plans, sequences, impact-free tests) and cyber recovery — immutable snapshots, behavioral analysis to find the CLEAN restore point, and the Isolated Recovery Environment where you remediate before switching production back on. Because after a ransomware the problem isn't restarting: it's restarting clean.

IRE
the isolated remediation environment: you validate there, you switch back on after
Immutable
snapshots the ransomware can't encrypt nor delete
Runbook
the failover orchestrated and testable: DR with dress rehearsals
Live Recovery
OFFICIAL VMWARE BRANDING · LIVE RECOVERY
CONSOLE REALE · DATA PROTECTION & RECOVERY · FONTE: VMWARE BLOG
REAL CONSOLE · DATA PROTECTION & RECOVERY · SOURCE: VMWARE BLOG
02 · How to use it well

The things that make the difference.

The two restarts

The classic disaster · site lostthe DR of always
Replication & plans
Immutable snapshots
Analysis & clean point
copy · safe · diagnosis
IRE · the isolated remediationthe restart without reinfection
Ransomware · the modern disasterthe case that changes the rules
Plan B, 2026 edition

The clean point found

The analysis points to the last healthy snapshot: you restart from there, not from yesterday's infected backup.

Remediation in quarantine

The VMs validated in the IRE with security tools: production switched back on only clean.

Plans per application

Order, IPs and dependencies written down: the runbook that works at 3 a.m.

Impact-free tests

The failover rehearsed in a bubble, twice a year: the evidence for NIS2 and insurers.

03 · In depth

Ransomware recovery with IRE and vault

VMware Live Recovery unites DR (formerly SRM/VCDR) and cyber recovery: continuous replication (vSphere Replication/VCDR with immutable snapshots on a cloud file system), orchestrated recovery plans with non-destructive tests, and for the ransomware the Isolated Recovery Environment: the VMs are switched on in an isolated bubble with NSX, the behavioral analysis (NGAV) watches them running, you iterate back in time to the clean copy, then you promote it.

  • IRE — the isolated bubble where to switch on the copies: the test without reinfection risk
  • Immutable snapshots — the restore point the attacker can't encrypt
  • Behavioral analysis — the VM observed while running: the sleeper flushed out before the return
  • Recovery plan — sequences, networks and scripts orchestrated: push-button DR
  • Non-disruptive tests — the rehearsals without touching production: the audit with the evidence
  • PiT deep history — you go back to the healthy copy: the recovery timeline
04 · Numbers and lifecycle

The numbers that matter.

RPO min
with continuous replication
2/anno
the DR tests we consider the minimum
100%
of the copies verifiable in the IRE before the return
h
the ransomware recovery orchestrated: not weeks
From ransomware you come back with a rehearsed plan: runbooks, IRE and periodic rehearsals — the recovery that works when needed.
05 · Use cases

Where it really pays off.

Cyber recovery

Ransomware in the risk model, with the answer ready.

Platform DR

Site B orchestrated for the vSphere estate.

Continuity compliance

RTO/RPO declared and demonstrated.

After the attack, haste reinfects: Live Recovery restarts clean — we write and rehearse the plan.