A restore point is a saved recovery snapshot that lets an organization roll data back to an earlier state after loss, corruption, or malicious change. It may represent a file set, system image, or application state captured at a specific time. Unlike a simple “backup exists” status, a restore point is only useful if it is recent, complete, and can be restored reliably.
In cyber security, restore points matter because ransomware, accidental deletion, and failed updates often force rapid rollback. Defenders use them to recover systems without rebuilding everything from scratch, but attackers may try to delete, encrypt, or age out restore points before launching impact. Good practice is to test restores regularly, keep multiple versions, and protect recovery data from the same permissions and credentials used on production systems.