What Would Happen if Your Software Vendor Suddenly Became Non-Responsive?
Let's imagine that your software vendor goes out of business tomorrow. Your organisation still has its data. However, the application that runs your organisation does not work anymore.
You have backups. You have a contract. Do you have all the necessary means to rebuild this software?
This is the reality of software recoverability.
As businesses rely more and more on third-party software and cloud platforms and AI-driven applications, it is important not just to preserve software, but also to be able to recover and operate independently.
The Risks of Vendor Reliance
A vendor's failure may result in much more than just inability to access the application. Businesses will find themselves without code, technical knowledge and infrastructure needed to continue operating.
Some recent examples show how real this risk can be:
- AI Security Issues in India: On 15 October 2026, CERT-In issued a critical advisory about AI agents that were acting outside of their intended scope and were accessing live systems of Indian organisations.
- Software security issues: In October 2026, ConnectWise had to report a security incident and suspend some of its services.
- Dependency on cloud infrastructure: When something goes wrong with the cloud platform, other services could suffer despite no disruptions in the enterprise's own infrastructure.
Such events are typical examples of a recurring issue: enterprises rely on technology and services that are out of their full control.
Recoverability enables them to get prepared to rebuild critical software in case of an unavailability of a certain vendor or a supporting service.
How AI Is Changing Software Recoverability
There are new challenges and opportunities that come with the use of AI in software development and operation.
The new challenge
An application powered by AI might depend not only on source code but also on the following assets:
- Versions of the model and configurations;
- System prompts and agent instructions;
- Data pipelines and evaluation datasets;
- APIs from other sources and third-party tools;
- Permissions, deployment and infrastructure configuration options.
Without such assets, restoring the source code alone would not bring back the application.
The opportunity
At the same time, AI can assist software recovery teams in:
- Analysis of complex codebases and detection of dependencies
- Generation of technical documentation and deployment instructions
- Detection of missing components in software deposits
- Support of build verification and recovery testing
However, AI can only ensure successful recovery to some extent – its outputs will still require reviewing, testing and validation by professional experts.
Guidance on AI Software Bills of Materials were also released by CISA and G7 partners in 2026, emphasising the importance of knowing what's behind AI-powered software solutions.
Software Escrow: The Basis for Recoverability
Software escrow provides protection to businesses against certain risks related to vendors.
In a typical scenario, the vendor makes certain software material deposit into an independent third party. The beneficiary of the arrangement can access these materials upon meeting certain release conditions.
However, having the source code is not always sufficient for making software recoverable.
It can become outdated, it can lack necessary details or become dependent on unavailable tools and configurations.
A better recoverability approach should take into account the following:
- Source code: The current and correct version of the application.
- Dependencies: Libraries, packages and compatible versions of software.
- Deployment materials: Build scripts, configuration files and infrastructure requirements.
- Technical documentation: Information required for rebuilding and running the application.
- AI-specific materials: Relevant models, prompts, agent configurations and data pipeline materials, when possible and allowed by contract.
- Recovery evidence: Results of independent build, deployment and verification tests.
The goal here is to determine whether the software can actually be recovered, not to prove that the materials have been escrowed.
How Castler Is Tackling Software Recoverability
Castler offers a solution in its Software Recoverability Platform by combining software escrow with AI-assisted verification and engineer-reviewed recovery evidence.
- Castler's method is based on one fundamental question: Is it possible to rebuild and deploy the software without relying on the original vendor?
- Here's how it works: The process includes four crucial aspects:
- Secure software custody: critical software materials are escrowed.
- AI-assisted verification: automated procedures help rebuild, deploy and verify the software independently.
- Engineer review: a verification engineer evaluates the evidence and approves the verification result.
- Documentation: businesses get recovery artefacts related to the verification conducted, including build reports, deployment runbooks and software components inventory.
Castler calls this result the Signed Proof of Recovery.
This means shifting the focus from simply keeping the source code to proving that a certain release of the software has been rebuilt and tested.
For businesses working with multiple software vendors, this solution allows structuring the recoverability assessment for critical applications.
How Regulations Apply to Businesses in India and Internationally
Software recoverability is another aspect important in relation to third-party technology risks and operational resilience.
In India
Third party IT risks in the context of IT outsourcing regulation at Reserve Bank of India. Additionally, RBI requirements for certain regulated entities contain provisions related to source-code access or escrow arrangements in relation to critical systems.
Depending on the particular direction and regulated entity in question. However, these requirements should not be perceived as a universal escrow requirement for all Indian businesses.
Internationally
The EU Digital Operational Resilience Act (DORA), applicable as of January 2025, enhances ICT risk management and third-party oversight in relation to in-scope financial entities.
By September 2026 the European Banking Authority issued final guidance on third-party risks, including due diligence, monitoring and exit strategy procedures.
The general takeaway is obvious - organisations need to be aware of their technology dependencies and to be prepared to handle the cases when the supplier is no longer able to provide them with necessary assistance.
A Practical Checklist for Improving Software Recoverability
There are a number of things that organisations can do to begin improving their recovery preparedness:
- Identify critical software: Figure out what software applications are necessary to run day-to-day operations.
- List dependencies: Record all third-party services, integrations and infrastructure required.
- Check escrow agreements: Evaluate release conditions, access permissions and completeness of the escrowed material.
- Confirm recoverability: Ensure that the software can be reconstructed and launched independently.
- Establish recovery objectives: Define the acceptable downtime and data loss levels.
- Maintain up-to-date documentation: Update recovery assets in response to changes in software and dependencies.
- Perform regular tests: View recovery as an on-going effort, not a one-off task.
These steps enable organisations to uncover any potential shortcomings prior to an actual event.
Conclusion: Recovery Needs to be Proven, Not Presumed
AI can assist software recovery, but it is incapable of replacing software custody, proper contractual arrangements and independent testing.
Recoverability is best measured by the ability of the organisation to prove that its critical software can be recovered when the original vendor is no longer available.
Castler, with its emphasis on AI-enabled proof of recovery and evidence of recoverability, does just that.
Because business continuity should never depend entirely on a vendor being there when you need them.