Cloud Resilience University: cloud disaster recovery lessons and glossary
Ten lessons in three tracks for security leaders, SRE and platform teams who need to judge whether a cloud estate could be recovered: Basics, Buying and Running it. Start with the five layers of cloud recovery if the category is new to you.
Ranking current as of September 2026 · By the Cloud Resilience Vendors research desk
Basics: what does cloud recovery have to bring back?
What cloud recovery has to bring back, and the strategies for doing it.
Lesson 1
The five layers of cloud recovery
Data, configuration, network, identity and DNS, and why a backup covers only the first.
Lesson 2
Cloud disaster recovery strategies
Backup and restore, pilot light, warm standby and active/active, and what each needs from infrastructure.
Lesson 3
Configuration drift and why it breaks cloud recovery
The gap between what runs and what you think runs, and the two places it hurts a rebuild.
Lesson 4
Infrastructure as code as a recovery asset
Why official guidance recommends it for rebuilds, and the four gaps it leaves.
Buying: how do you judge vendors and prices?
How to read vendor claims and pricing, and how to build a shortlist.
Lesson 5
How to read a cloud recovery vendor's claim
Turning published RTO, RPO, coverage and immutability claims into questions you can check.
Lesson 6
How cloud disaster recovery tools are priced
Assets, core resources, terabytes and tiers, and which vendors publish a number.
Lesson 7
How to shortlist cloud disaster recovery tools
Six product categories, what each rebuilds, and how to pick two or three for a trial.
Running it: how do you make recovery work in practice?
Designing recovery targets and recovering the layers plans tend to miss.
Lesson 8
Designing a cross-region and cross-account recovery target
Same account, another region, or a clean account: what each protects against and what to prepare.
Lesson 9
Recovering identity and DNS
The first and last layers of a rebuild, and the ones most plans leave to people.
Lesson 10
Recovering from bad changes and AI agent infrastructure
Point-in-time rollback for automation errors, and the 2026 vendor moves on AI agent recovery.
Where are the definitions?
The cloud resilience glossary defines 39 terms, with links to the standard, regulator or official guidance a term comes from.
What should you read next?
For longer analysis, see Briefings. For the vendor view, see the ranking and the buyer's checklist. Common questions are answered in the FAQ.
Frequently asked questions about the University
Who are the lessons for?
Security leaders, SRE and platform teams who need to decide whether a cloud estate could be recovered after ransomware, an outage or a bad change, and which tools would help.
Do I need to read the lessons in order?
No, but the Basics track explains the terms the other two use. Each lesson ends with a link to the next one.
Are the lessons based on testing?
No. They are written from public vendor material, official guidance such as the AWS and CISA documents cited in each lesson, and standard definitions. Sources are listed at the end of every lesson.