Recovery points are backup snapshots or restore states that let defenders roll systems back to a known-good condition after disruption. They may come from scheduled backups, storage snapshots, or immutable backup systems, and they capture data, configuration, or both at a specific moment in time.
They matter because ransomware, destructive malware, and accidental deletion often make live systems unreliable. If attackers encrypt files, wipe servers, or tamper with settings, recovery points can be the fastest way to restore operations without paying extortion demands. In practice, defenders should test that recovery points are complete, recent enough, isolated from production accounts, and protected from deletion. Good recovery points help limit downtime, but weak ones can fail when needed most.