Recovery needs clean dependencies

Restoring a system onto infrastructure that is still compromised puts you back where you started.

The restored application depends on a directory, a network, a management platform and a set of credentials, and if any of those are still under the attacker's control the recovery is cosmetic. Working out which dependencies are trustworthy is frequently the longest part of a major recovery, and the part nobody plans for.