Every organization that has run a disaster recovery drill knows this feeling: the moment you have to choose between being clean and being current.
Roll back to a known-good backup, and you’re safe. But you’ve also erased a day, or three, of onboarding, access changes, and legitimate business activity. Restore to the most recent state instead, and you stay current. But you might be restoring the attacker right alongside everyone else.
For as long as disaster recovery has existed, that trade-off has been the cost of doing business. Today, we’re ending it with Secure Replay.
Introducing a new kind of recovery
Quest Identity Recovery now includes a new capability called Secure Replay, now in Private Preview, giving organizations something recovery hasn’t offered before: a forest that is both clean and current.
Here’s how it works. Secure Replay restores your Active Directory forest to a verified clean point in time, a state you know with confidence predates the compromise. From there, it draws on live change data from Quest Identity Defense to reconstruct everything legitimate that happened after that point. Onboarding events, access changes, group membership updates, the ordinary day-to-day activity of a real organization.
It separates that legitimate activity from the attacker’s footprint automatically. Anything it can’t confidently call safe gets flagged rather than silently replayed. And wherever possible, it lays out the full attack path, so you understand exactly what happened and how, not just that something happened.
The result is a forest that’s safe and current at the same time, without the guesswork.
Why this matters right now
Identity has become the primary attack surface in nearly every major breach. Attackers aren’t breaking down firewalls anymore. They’re logging in as someone who already has legitimate access, and Active Directory is the crown jewel they’re after.
That changes the question every organization has to answer. It’s no longer if this happens, it’s when. And until now, the honest answer to “what happens after?” has come down to restoring what you can and hoping you got the timing right.
Secure Replay is the first real answer that doesn’t ask you to gamble.
It only works because Identity Recovery and Identity Defense operate as one system and use AI to fuse together two solutions. Detection and recovery have historically been deployed as separate concerns. Here, they become one continuous capability. The same AI that spots the threat is what makes clean, current recovery possible in the first place, because Identity Recovery is reading real detection data, live, from Identity Defense.
What this means for you
Picture the worst day of your year. Your Active Directory environment is compromised, and recovery is underway. In the past, this is the moment you’d be forced to choose between losing real work to get clean or staying exposed to keep running.
With AI-guided Secure Replay, that choice disappears. You get a forest that reflects every legitimate change your team made — every onboarded employee, every access change, every group update — without carrying the attacker’s footprint forward. Automatically. No manual reconciliation and no educated guessing about which changes are safe.
This isn’t an incremental improvement to backup and recovery. It’s the end of the trade-off era.
Secure Replay is available now in Private Preview. Learn more about Quest Identity Recovery.
