Unlike physical disasters where the damage is immediately visible, a cyberattack can impact systems in ways that take one to two days just to identify. Teams must first map the blast radius before they can begin any recovery work, making standard RTO estimates unreliable.