IGEL launches Emergency Mode to speed endpoint recovery

IGEL has made its Emergency Mode feature generally available within its Business Continuity & Disaster Recovery offering.

The software lets authorised administrators reboot supported Dual Boot-enabled endpoint devices into IGEL OS during a cyberattack or Windows outage, rather than relying on individual users to start recovery on their own machines.

The tool targets a common weak point in incident recovery: the gap between restoring central systems and getting employees back to work on affected endpoint devices. While servers, networks and applications may be recovered relatively quickly, staff can remain locked out if their Windows machines are under investigation, being reimaged or waiting to be replaced.

From the Universal Management Suite, administrators can restart a single device, selected groups of devices or an entire fleet. Once switched, devices remain in IGEL OS until an administrator changes them back to Windows.

The Windows partition stays isolated and preserved during the process, allowing security and IT teams to review the system for forensic or compliance purposes while users regain access to approved applications and resources on the same hardware.

Recovery gap

The launch comes as ransomware remains a persistent concern for large organisations and public sector bodies. IGEL cited figures from the FBI's 2025 Internet Crime Report showing ransomware complaints rose by 14.42% in 2025.

That has increased interest in products that can reduce downtime at the employee device level, particularly in sectors where disruption can have operational or public consequences. IGEL identified healthcare, financial services, government, transport and critical infrastructure as key areas where endpoint access recovery could help keep services running during a wider technology incident.

In those settings, the ability to restore user access in minutes could help maintain patient care, financial transactions, public services and other core operations while incident response teams continue investigating the affected Windows environment.

"Organisations have invested heavily in the ability to quickly recover data and infrastructure, but few can recover user access at the endpoint just as quickly," said Klaus Oestermann, Chief Executive Officer, IGEL.

"IGEL Emergency Mode closes that gap by giving administrators a controlled way to reconnect people to authorized resources in minutes," Oestermann said.

Operational use

IGEL frames the product around a "reboot, reconnect, resume" approach. In practice, that means moving supported devices out of a potentially compromised or unavailable Windows environment and into IGEL OS so users can continue working while remediation proceeds in parallel.

This matters because the recovery targets organisations set do not always match the experience of end users during a live incident. Even when systems are technically restored, staff may still face delays at the desktop or laptop level if each machine requires separate attention.

"The recovery time objective (RTO) and the actual recovery time (RTA) your users experience during an event are rarely the same number," said Sterling Wilson, Field CTO for Business Continuity & Disaster Recovery, IGEL.

"Emergency Mode puts endpoint access recovery inside the incident response timeline, so administrators aren't managing it as a separate, device-by-device project," Wilson said.

The feature complements broader incident response and resilience programmes rather than replacing them. It is intended to sit alongside data resilience tools, security operations, threat removal work and endpoint remediation.

That positioning reflects a wider shift in the cyber recovery market, where suppliers are trying to address not only infrastructure restoration but also workforce continuity. For many organisations, the challenge is no longer limited to recovering central systems after an attack. It is also about maintaining controlled access for staff without undermining investigation and containment efforts.

By preserving the Windows partition while allowing access through IGEL OS, the company is trying to balance those priorities. Security teams can keep evidence intact for examination, while operational teams can bring users back online without waiting for every affected endpoint to be rebuilt.

IGEL said Emergency Mode is available at no additional cost to eligible customers using its Business Continuity & Disaster Recovery offering.