- Home
- Offensive Security & Hunting
- Ransomware readiness
Prepare for the one scenario
that closes businesses.
We assess the controls and decisions that decide how a ransomware attack ends: tested restores, segmentation, privileged access, detection and the first six hours. You get a scored rating and a prioritized fix list.
Backups and insurance are not a plan.
The organizations that recover quickly from ransomware are the ones that prepared before the encryption started. That means backups that cannot be encrypted and have actually been restored, a network the attacker cannot cross freely, privileged accounts locked down, detection that sees ransomware behaviour early, and leaders who know who decides what in the first hours.
A readiness assessment examines each of those, scores them, and tells you what to fix first. It draws on what our incident response team sees on live engagements, and it produces the evidence of tested restores that insurers increasingly ask for.
- A scored readiness rating across each control area
- Backup immutability and restore-test review, with evidence
- Segmentation, Active Directory and privileged-access findings
- A ransomware-behaviour detection and EDR coverage check
- A review of first-six-hours decision-making and who owns each call
- A prioritized fix list, ranked by impact
Assess, score, prioritize.
Scope
We agree the systems, sites and teams in scope and the evidence we will need to see.
Assess the controls
Backup architecture and restore tests, segmentation, tier-zero and privileged access, and detection coverage for ransomware behaviour.
Test the decisions
We walk your leadership and IT through the first six hours of an attack to find who decides what, and where the plan is silent.
Score and prioritize
A readiness rating and a ranked fix list, briefed to leadership and your technical team.
Five areas that decide the outcome.
Backups
Immutability, separation from the production domain, and whether restores have been tested at the scale you would need.
Segmentation
Whether an attacker on one machine can reach everything else, including backups and OT.
Privileged access
Active Directory hardening, tier-zero isolation and the admin accounts ransomware operators look for first.
Detection
EDR coverage gaps and whether ransomware precursors, not just encryption, raise an alert.
The first six hours
Who decides to isolate, who calls the insurer and counsel, and who talks to staff and customers.
From readiness to response.
If ransomware hits, our incident response team handles containment, forensic root cause, recovery and coordination with your insurer, counsel and regulators. With a retainer, terms are agreed before the day.
- 24/7 activation through our incident team
- Containment, eradication and recovery
- Threat actor identification and sanctions screening before any negotiation
- Coordination with insurers, legal counsel and regulators
Who it is for
Boards, insurers and any organization whose downtime is measured in hours. Particularly useful before a cyber-insurance renewal, or after a peer in your sector has been hit.
- Cyber war gaming, rehearse an attack with real ransomware
- IR retainer, the response team agreed in advance
- MDR, catch the precursors early
- Cyber insurance support, turn the evidence into a better renewal
What buyers ask.
We have backups and insurance.
Then the questions are whether the backups survive an attacker with domain admin, and whether you have restored from them at scale. Insurers increasingly ask for evidence of tested restores. This assessment produces it.
How is this different from a penetration test?
A penetration test finds ways in. Readiness asks what happens once an attacker is in and starts encrypting: how far they get, how fast you notice, and how quickly you recover.
Will you help us negotiate if we are hit?
Yes. Our incident response team negotiates with threat actors on your behalf, after threat actor identification and sanctions screening. We never recommend paying. Negotiation buys time, intelligence and options while we contain the attack and recover your systems.
What do we get at the end?
A scored readiness rating and a prioritized fix list, ranked by impact, that you can re-measure against.
Be ready before you need to be.
Put an engineer on a call to scope a ransomware readiness assessment. No charge, no commitment.