Inside the session
Recovery plans look their best in the runbook and their worst mid-incident. In a 2026 survey of 583 cloud IT leaders, 92% were confident they could restore critical data during a major outage, yet 60% needed six or more hours to finish a full restore.
SoFi refused to live with that gap. The session, recorded live with Techstrong on September 10, 2026, is the play-by-play of what the team did about it. (The old world: agents on every file server, storage limits that turned into surprise bills, and restores that started with a ticket and a prayer.)
You'll hear:
- What the old setup actually cost the team, in hours, tickets, and one very stressful morning.
- Why full-snapshot rollbacks put a hidden ceiling on recovery speed, and what granular restore changes about incident response.
- How self-service restores coexist with bank-grade audit and retention controls.
- Shannon's take on AI cutting both ways, from her team's own coding agents to attack crews running campaigns at swarm scale.
- What Bill sees across AWS customers, including the anti-patterns and what good recovery testing looks like.
Who's on the panel
- Shannon Bradley, Manager, DevOps Engineering at SoFi. Runs the corporate infrastructure team behind the rebuild.
- Bill Quigley, Partner Solutions Architect at AWS. Storage-partner background and an active member of AWS's Resiliency Technical Field Community.
- Liore Shai, Solutions Architect at Eon. Moderates the conversation.
- Jared Harris, Operations Manager at Techstrong Group. Hosts the session and runs audience Q&A.
Key takeaways from the session
- Restoring everything to recover one thing is the hidden speed limit. At multi-region scale, full-snapshot rollbacks turn a five-minute problem into an all-day one.
- Standing this up was a sprint, not a program. With nothing to install, protection reached the whole footprint in weeks, and it now attaches to new resources as they appear.
- Compliance never slowed self-service down. Scoped restore targets and role-based access let engineers recover without asking permission twice, with every action logged.
- Recovery is a muscle. SoFi drills restores on a schedule, because the worst time to learn your real recovery speed is mid-incident.
- AI cuts both ways. Agents ship changes at machine speed, attackers run campaigns at swarm scale, and recovery has to keep up with both. Shannon's line about one burglar versus twenty makes the shift stick.
- Boring is the goal. The best restore story is a quick fix and a calm Slack thread.
Where Eon fits
SoFi's rebuild runs on Eon Data Protection. Eon discovers and classifies data across every account and region, and protection policies attach with immutability and logical air-gapping by default. Engineers run granular restores themselves, and recovery copies live outside production's blast radius, with built-in ransomware detection. The same layer covers recovery from AI-driven threats.
The full story sits in the SoFi case study. Over 100% ROI in the first year is the headline, and the recovery speed is the part attendees kept asking about.
See how the same approach maps to your own AWS environment: request a demo.
Frequently asked questions
How fast can SoFi recover data now?
In minutes, down from a full day. Granular restore brings back a single row or file without rolling back everything around it, and full-instance restore covers the bigger failures.
What did the rollout across five AWS regions involve?
Under four weeks, end to end. Eon connects through a read-only role, discovers resources across accounts and regions, and applies protection policies as new resources appear, so there were no agents to deploy and no per-region setup.
Can engineers run their own restores in a regulated environment?
Yes. SoFi scopes restores to approved target accounts with role-based access, keeps an audit trail on every action, and manages protection policies through Terraform so nothing changes by accident. Retention updates for requirements like student-loan servicing rules apply in seconds.
Does moving to Eon replace native AWS snapshots?
No. Eon extends what native AWS tools already do rather than replacing them. Native snapshots stay a solid floor, and the rebuild added cross-region consistency, granular restore, immutability, and recovery copies that live outside the reach of production credentials.
How does SoFi test recovery?
Monthly. The team restores real files and folders on a schedule, and the next step is regular full-scale recovery drills to measure exactly how fast a worst-case restore runs.
Why put ransomware detection inside the recovery layer?
Because attackers target recovery copies first, and an immutable copy of an infected database is still infected. Eon scans protected data, flags when a resource stopped being clean, and points the restore at the last clean copy.
