A major U.S. airline runs petabyte-scale unstructured data across airports, data centers, and multiple public clouds. Flight operations data, passenger records, maintenance logs, and AI/ML platform inputs: the estate is large, distributed, and critical.

When a senior IT engineer at the airline guided the team through a ransomware tabletop exercise, the goal was straightforward: simulate an attack, validate the recovery plan, build confidence. What the exercise actually produced was a set of questions the team could not answer. Not because the technology had failed, but because nobody had ever asked them.

"Having a copy is one thing," the engineer said. "Knowing that a copy is clean is something different. That is where ransomware operators gain leverage."

Here are the five questions the tabletop surfaced, and how the airline worked through each one.

At the airline, decades of unstructured data had accumulated across on-premises storage, multiple sites, and cloud environments. Files, records, NAS shares, and filesets had grown organically without a centralized inventory. When the tabletop asked the team to map the data estate, there was no map to pull up.

This is not an airline-specific problem. Most enterprises with long-running infrastructure have the same blind spot. Data accumulates faster than documentation, and nobody audits file ownership until something goes wrong.

Rubrik's NAS Data Discovery capability gave the team a way to scan and inventory the full unstructured data estate, surfacing file ownership, access patterns, data age, and sensitive data presence at scale. The starting point for any protection strategy is knowing what you are protecting.

This is the question most teams never ask until they have to. Backups existed at the airline. Schedules were running. Health checks were green. But when the tabletop forced the question, confirming that a specific backup was uninfected and safe to restore from, the answer was uncertain.

Ransomware operators understand this gap well. Dwell time before detonation is often measured in weeks. A backup taken during that window may already be compromised. An organization that cannot distinguish a clean recovery point from an infected one is in a difficult position.

Rubrik's threat hunting and turbo threat hunting capabilities allow teams to proactively scan backup data for indicators of compromise before committing to a restore. Combined with immutable, air-gapped backup storage where even a compromised Active Directory cannot touch the backup estate, the team moved from assumed cleanliness to verified cleanliness.

Ownership drift is one of the most underestimated risks in long-running IT environments. Applications get migrated, teams get reorganised, and the person who originally set up a file share leaves the company. The data stays. The ownership context does not.

During the tabletop, the team found that applications they had considered non-critical turned out to depend on business-critical data. Some systems they had assumed were essential turned out to matter far less. Departments had different views of what mattered most, and those views had never been reconciled in a single recovery plan.

Getting IT, Security, and Legal into the same room before an incident is not optional. The tabletop exercise forced that conversation at the airline. The result was a data ownership map that became the foundation of a priority-ranked recovery plan, a first for the organization.

Even with clean backups and a data map, recovery fails without sequencing. Day 1 of a ransomware recovery is not about restoring everything. It is about restoring the right things in the right order so the business can function while the rest comes back.

At the airline, the tabletop revealed that the existing recovery plan lacked this granularity. Critical dependencies between systems had not been fully documented. Without a priority-ranked recovery order, the team risked restoring non-critical systems ahead of the ones the airline actually needed to operate.

Rubrik's Data Remediation capability enables surgical recovery, identifying the exact clean point in time for each system and restoring in a defined order rather than all at once. Raj Gupta, Rubrik's Product Manager for Unstructured Data, frames it simply: "Seed it. Rank it. Secure it." Know what you have, prioritize by business criticality, and lock it down with verified recovery points.

Documentation is not the same as confidence. A recovery plan that has never been tested is a hypothesis. At the airline, the tabletop was the test, and it revealed that the hypothesis did not fully hold.

NAS filesets and Linux filesets were explicitly unprotected at the time of the exercise. These were known gaps that had not triggered action until the simulation made the exposure visible. With Rubrik, those workloads came under unified policy-driven protection across the full hybrid and multi-cloud environment, covering VMware vSphere, Nutanix AHV, SQL Server, Oracle, Active Directory, and Windows filesets alongside the newly protected NAS and Linux workloads.

The tabletop also produced something less tangible but equally important: the habit of asking hard questions. The airline's team now has a validated recovery plan, defined data ownership, and a tested process. The confidence that comes from that is not a feeling. It is evidence.

The airline's digital strategy runs on AI/ML platforms and a modern cloud data stack. The unstructured data feeding those systems has to be trustworthy. The tabletop exercise was not a detour. It was how the team built that confidence. Rubrik protects over 1 trillion files globally across its customer base; one customer alone protects 60 billion files on a single platform. If your team has not yet run a ransomware tabletop, start with these five questions.