Ransomware response: the first 15 minutes determine the outcome

The organisations that handle ransomware well share one characteristic: they had thought about what to do before it happened.

Not necessarily a formal playbook. Sometimes just clear ownership — someone who knows they are the incident commander, someone who knows which systems to isolate first, someone who knows not to reboot the encrypted machine because the decryption key might still be in memory.

The organisations that handle it poorly usually have the opposite: a gap between the moment of discovery and the moment someone makes a decision. In that gap, the attacker continues operating. Backups may be encrypted. Logs may be deleted. Additional systems may be compromised.

This guide is about closing that gap — and what to do in each phase after it is closed.

Why response fails before it starts

Most ransomware response failures are not technical. They are organisational.

Nobody is clearly in charge. When an incident is discovered, the natural human reaction is to escalate — to a manager, to a director, to someone else. If the escalation chain does not end in a designated incident commander within the first 15 minutes, decisions get made by committee or not at all.

The first instinct is to fix, not to contain. Rebooting affected systems, running antivirus scans, and trying to decrypt files — all of these feel productive and all of them can destroy evidence, allow the attacker to detect the response, or accelerate damage.

Communication goes sideways. Ransomware events produce pressure to communicate quickly. Without a coordinated communication plan, inconsistent messages reach employees, customers, insurers, and regulators simultaneously — creating a secondary crisis alongside the technical one.

The decision sequence: first 15 minutes

Before touching anything, establish three things:

1. Assign an incident commander. One person accountable for coordinating response. Not the most senior person available — the most prepared person available.
2. Define the scope you know. Which systems are visibly affected? What was the vector if known? What is still running cleanly?
3. Decide what to isolate. The goal in the first 15 minutes is to stop the spread, not to fix anything.

The isolation decision is the most consequential early action. A system removed from the network cannot spread ransomware. A system left connected while you investigate can. If you are uncertain, isolate — investigation can happen offline.

Do not power off affected systems unless physical safety requires it. Volatile memory may contain the encryption keys, malware artefacts, or attacker tooling that forensics will need.

Containment: stopping spread before you clean up

Effective containment requires thinking about how ransomware moves, not just where it has already been.

Block lateral movement paths. Disable SMB (port 445) between segments where feasible. If your network is flat, this is the moment you discover why segmentation matters. See enterprise LAN design for what a segmented network looks like.

Reset privileged credentials immediately. Domain admins, backup admins, and cloud global admins first. These are the accounts attackers use to maximise damage. Assume any privileged credential that could have been accessed is compromised until proven otherwise.

Audit remote access entry points. Check VPN accounts, RDP exposure, and third-party remote access portals. These are common entry vectors and common re-entry paths. Revoke external access broadly during active containment — add it back selectively during recovery.

Protect backups before you need them. Verify that backup systems are isolated and integrity-check that your most recent clean backup is actually restorable. Ransomware operators frequently target backups specifically because they know it removes your recovery option.

The data theft question: answer it early

Modern ransomware is almost always double extortion: encryption plus exfiltration. If the attacker has already copied your data, restoring from backup does not eliminate the extortion risk.

Assess this as early as containment allows:

• Review egress and DNS logs for unusual external traffic in the preceding 24 to 72 hours
• Look for bulk archive creation — zip, 7z, and similar tools are indicators
• Check cloud storage activity and any SaaS applications that could have been used for exfiltration
• If you operate a virtual data room, check audit logs immediately and revoke all external access while investigation continues

The IBM Cost of a Data Breach Report 2025 puts average breach costs well above $4 million globally — a figure driven significantly by the combination of operational impact and data exposure. Early exfiltration assessment determines which communications and disclosures are necessary.

Communication: the secondary crisis you can prevent

Ransomware events are communication events as much as technical ones. Inconsistent messaging creates its own damage — to customer relationships, regulatory standing, and insurance claims.

Establish a single source of truth early. One document, one owner, updated as facts change. Then communicate outward in a sequence:

• Internal first: employees need to know what to do (and what not to do) before they start responding to customer questions or posting on social media.
• Insurance and legal counsel early: ransomware events have legal and financial implications. Your insurer and counsel should be notified as soon as the event is confirmed, not after you have made decisions.
• Regulators according to applicable timelines: GDPR, state data breach notification laws, and sector-specific regulations have different notification requirements. Know your obligations before an incident, not during one.
• Customers and partners when you have something accurate to say, not before.

Recovery: restoring without reinfecting

The most common recovery mistake is restoring systems before the entry vector is closed. If the attacker’s access path is still open, you can restore and be reinfected within hours.

The correct sequence:

1. Identify how the attacker got in. Phishing, exploited VPN credential, unpatched service, or supply chain compromise — the answer determines what you close before restoration.
2. Close the entry vector and verify it is closed.
3. Rebuild critical identity infrastructure first — Active Directory, MFA, and monitoring — before restoring operational systems.
4. Restore from verified, clean backups. Scan before reconnecting.
5. Monitor for re-entry aggressively during the first two weeks. Watch for repeated authentication attempts, unusual lateral movement, and new persistence mechanisms.

After recovery: the improvements that prevent recurrence

Use the post-incident period to close the structural gaps the attacker exploited:

• MFA everywhere, with no legacy authentication exceptions
• Privileged access only through controlled, time-limited channels
• Network segmentation that limits lateral movement
• Immutable or air-gapped backups that ransomware cannot reach
• A tested incident playbook, so the decision sequence is clear before the next event

FAQ