‘You can’t stop cybercrime, so you’d better be able to recover’: Mike Osborne talks resilience and sovereignty

Databarracks’ chairman discusses regulation, data sovereignty, the role of MSPs and why resilience is becoming a boardroom priority

Cybersecurity may continue attracting the lion’s share of technology spending, but Databarracks’ chairman Mike Osborne believes organisations are beginning to accept a difficult reality: preventing every cyberattack is impossible.

In an interview with CRN, Osborne argues the focus is shifting from prevention to recovery as tighter regulation, ransomware threats and geopolitical uncertainty drive demand for resilience services.

“You can’t stop cybercrime because it only takes one person to click a malicious link,” he says.

“But soon organisations may no longer be able to pay ransomware demands, so they have to be confident they can recover.”

Recovery becomes the priority

According to Osborne, the resilience market is undergoing a significant shift.

The UK government’s proposed restrictions on ransomware payments, alongside stricter regulation across critical infrastructure and the public sector, are increasing the need for robust recovery plans.

“The cost of cybercrime is around 50 times higher than what’s being spent trying to prevent it,” notes the chairman.

“If organisations know they won’t be able to pay a ransom, they have to make sure their recovery works.

“That means having air-gapped environments, tested recovery plans and leadership teams that know how to respond rather than simply react.”

Regulation raises the bar

Osborne says resilience requirements have evolved significantly in recent years.

Where organisations were once simply expected to demonstrate they had a business continuity plan, regulators now expect evidence that those plans are regularly tested and improved.

“Regulation has gone beyond asking whether you have a plan,” he says.

“Now organisations are expected to show when they last tested it, what they learnt and how they’ve improved it.”

He points to regulations including DORA and wider critical infrastructure requirements as evidence that resilience is becoming a board-level responsibility.

“Regulation has real teeth now,” Osborne says.

Sovereignty

Beyond cyber threats, Osborne believes data sovereignty has grown in importance and is now reshaping customer conversations.

As organisations accelerate AI adoption, many are also reassessing where their data is stored and which platforms process it.

“When people rushed into AI, many didn’t stop to think about the confidentiality of their data or the sovereignty of the AI engines using it,” he says.

“Now they’re taking a step back.”

The same thinking is influencing disaster recovery strategies.

Databarracks operates a UK sovereign resilience cloud, allowing organisations to keep both production and recovery environments within the UK while maintaining what Osborne describes as a true air gap.

He argues simply replicating workloads between cloud availability zones is no longer enough.

“We’re seeing organisations rethink how they’ve protected themselves historically,” he says.

“They’re asking where their recovery data sits and whether there’s a genuine air gap.”

The company’s technology ecosystem reflects that approach.

Databarracks works across AWS, Microsoft Azure and Google Cloud infrastructure while maintaining a vendor-agnostic approach to backup and recovery.

Osborne describes Commvault as its largest application partner, while also highlighting relationships with Rubrik and Everpure.

“There’s no single silver bullet,” he says.

“We need a portfolio that allows us to build the right solution for each customer’s environment.”

Macroeconomic challenges

While cyber resilience remains central to Databarracks’ proposition, Osborne argues customers’ concerns extend far beyond technology.

He cites geopolitical conflict, supply chain disruption, climate events and energy security as examples of risks now shaping resilience planning.

“It doesn’t have to be a technology conversation,” he says.

“It’s a risk and risk mitigation conversation.”

That broadening definition of resilience, he believes, will continue driving demand over the coming years.

“I think it’s got the attention of government, investors and wider stakeholders,” Osborne says.

“It’s a sector to keep your eye on over the next six to 12 months.”