Challenges
HUGO BOSS runs one of fashion’s most interconnected operations. Its own stores, e-commerce, logistics, and wholesale partners all exchange data across a large footprint of company-owned infrastructure. Collections turn over every six to nine months, but customer trust cannot be replaced, and shoppers are entrusting the brand with more personal data than ever. Beyond protecting that data, the business has to keep taking payments and keep stores and e-commerce available.
For CISO Stefan Baldus, the question is not whether something will happen but whether the business can get back to work when it does. Years of added platforms and applications had left backup tooling that was hard to operate, dependent on specialist expertise, and offered no central view of recoverability. With roughly 60% of the estate in the cloud and a Microsoft-centric environment, identity had become the first thing that had to come back. And with AI raising the odds that an attack reaches the whole company, Stefan needed to know which restore point was clean and to show the business how fast recovery really is.
Three challenges stood in the way:
1
Three Legacy Backup Solutions Across a Diverse Estate
2
Knowing Which Restore Point is Clean, and What Recovery Looks Like to the Business
3
Identity, the First Thing that Must Come Back, Left Exposed
Outcomes
With Rubrik in place, HUGO BOSS has a security-led recovery foundation built to withstand an attack that reaches the whole company:
One Platform Replaces Three Legacy Backup Solutions:
Mission-critical systems were onboarded first under central visibility, with automated policies protecting new workloads so the team can focus on strategy over administration.
A Known Last Clean Slate, and Recovery Validated with the Business:
Rubrik lets the team scan and search within backups to identify the last clean restore point before recovering, so restored systems can be trusted. Guided recoveries restore complete business processes end to end in an isolated environment, with recovery time measured and the results, including the agreed data-loss window, reviewed with the business.
Identity Protected, with a Recovery Exercise Planned:
Rubrik Identity Resilience now protects Entra ID, alongside Microsoft 365, so access can be restored first. A combined Active Directory and Entra ID recovery exercise is planned to put it to the test.
A Security Solution with Backups
Stefan frames the decision in reverse of how most teams buy: the goal was not to find a backup product with security features, but a security solution that happens to take backups. HUGO BOSS set out to replace three legacy backup solutions, starting with mission-critical systems across a highly diverse infrastructure. What mattered most was being able to scan and search within backups, so that if something goes wrong, the team knows the last clean state and can be sure that what it restores is reliable.
Resilience is now a practiced discipline, not a document. Working with the business, the team runs guided recoveries inside Rubrik, restoring entire business processes in an isolated environment with no outside pressure, then spinning them up to show stakeholders what recovery actually looks like and asking a simple question: is this acceptable?
As HUGO BOSS moves more and more into the cloud, identity is the essential thing that has to work first. If the company were compromised, its SaaS services run in a separate environment and should be unaffected, but users still need to get back in. The team protects Entra ID and Microsoft 365, including mailboxes, SharePoint, and Teams, and is planning an exercise to recover Active Directory together with Entra ID.
Looking Ahead: Agentic AI and the Minimum Viable Company
Stefan sees AI changing the shape of the risk. Where an attack once reached a single location or segment, AI is expected to find a way into every environment, which means a slow detection could affect the whole company. The team's response is to tighten identity privileges and patch management while keeping the business moving, not slowing it down.
With a growing number of AI agents across the business, HUGO BOSS needs an inventory and control plane to understand which carry risk, and the team is evaluating Rubrik Agent Cloud for that purpose. Stefan and team are also looking at Azure DevOps protection, as AI generates more of the source code the business relies on. Recovery priorities are also being rethought: instead of ranking business processes one by one, the focus is shifting to the minimum viable company - the smallest shared set of systems that must return first.