A plan you've never practiced is just paper.
Ransomware crews now steal a copy of your data before they lock it — so even good backups don't save you from the blackmail. Insurers and regulators want proof you've actually rehearsed what happens. We write the plan with you, run drills with your leadership team, and stay on call 24/7 if it ever turns real.
What's included.
- 01
IR plan authored for your firm
Not a downloaded template. The plan reflects your stack, your team, your regulatory exposure, your insurer's specific notification requirements.
- 02
Scenario runbook library
Distinct runbooks for ransomware, business email compromise, data exfiltration, insider threat, supply-chain compromise. Drilled, not just written.
- 03
Tabletop exercises — executive and technical
Quarterly drills. The technical team rehearses the runbook. Leadership rehearses the decisions — disclosure, communications, negotiations, customer notification.
- 04
24/7 retainer for activation
On declared incident, we activate within one hour. Pre-negotiated scope, pre-authorized to act. No emergency procurement cycle.
- 05
Post-incident lessons-learned
Every drill and every real incident ends with a written post-mortem and control updates. We update the plan; you stay improving.
- 06
Annual recertification
Full plan review against current threat landscape and regulatory changes. Plans drift faster than people realize.
The first hour of a real ransomware activation.
This is the runbook our IR team executes when a client declares a ransomware incident. Minute-by-minute, no narrative.
- T+0:00Detection. Client declares. Senator IR on-call paged via dedicated line.
- T+0:05Patient-zero endpoint isolated via EDR. Outbound network blocked at perimeter.
- T+0:10IR coordinator call established. Client CISO/IT, Senator IR lead, communications lead, legal counsel notified.
- T+0:15Legal and insurance notification — insurer's IR retainer activated where applicable; outside breach counsel looped in.
- T+0:25Scope assessment begins. Lateral movement search. Account compromise audit. Backup integrity check.
- T+0:30Leadership briefing #1: scope summary, containment status, immediate decisions required (continue operations? disclose now? pay or not pay?).
- T+0:45Communications plan freeze. No external statements without IR sign-off. Internal staff communication drafted.
- T+0:60Containment status update. Restoration plan begins to take shape. SEC clock starts ticking if applicable.
Notification windows that compound the breach if you miss them.
When the incident is confirmed material, the legal clock starts. Different frameworks, different windows. You need to know yours.
IR readiness — the maturity ladder.
Most firms self-assess one tier higher than their actual position. The honest test: when did you last drill?
| Plan in a binder, never tested | Annual tabletop with consultant | Quarterly drills + 24/7 retainer + full restore | |
|---|---|---|---|
| Insurance acceptance (2026) | Declining | Yes | Premium discount |
| Regulatory acceptance | Often insufficient | Yes | Yes |
| Executive readiness | Low | Medium | High |
| Recovery time when it's real | Days–weeks | Hours–days | Hours |
| Cost of unprepared incident | Average $4.9M (IBM 2025) | ~30% lower | ~60% lower |
What we track — and what each metric reveals.
Quarterly minimum. Higher cadence for high-risk firms.
Teams that have practiced fix things in roughly half the time of teams that haven't.
In quarterly restore tests. Most untested backups fail their RPO when actually tried.
% of leadership who can name the IR coordinator without checking. Deceptively useful.
Who needs this.
- Publicly traded companies (US SEC 8-K, similar regulators internationally).
- OSFI-regulated FRFIs (Canadian federally regulated financial institutions).
- Cyber-insurance applicants and renewals — universal requirement in 2026 policies.
- Anyone whose last 'IR test' was the actual incident.
- M&A targets in due diligence — buyers will ask for evidence of an IR program.
- Any organization holding regulated data (PHI, PII, PCI, financial) at material scale.
Q01Do we really need a plan? We have backups.
Do we really need a plan? We have backups.
Backups handle the encryption half of a ransomware incident. They don't handle the exfiltration half (double extortion is standard in 2026), the regulatory notification clock, the customer communication, the SEC disclosure, the insurance claim documentation, or the executive decisions in the first hour. The plan handles those.
Q02What's a tabletop exercise, actually?
What's a tabletop exercise, actually?
A facilitated discussion where the team walks through a realistic incident scenario in real-time. No actual systems are touched — the value is rehearsing decisions and communications under pressure with the actual decision-makers in the room.
Q03How often should we drill?
How often should we drill?
Quarterly is the 2026 baseline for any firm with material regulatory exposure. Annual is the minimum to satisfy most insurers. Daily is overkill — quarterly hits the right cost/value point.
Q04What does day 1 of ransomware actually look like?
What does day 1 of ransomware actually look like?
See the response runbook section above. The first hour is structured and time-boxed. The first day involves continued scope assessment, customer/regulator notification decisions, comms, restoration planning, and a lot of leadership-team interrupts. Drilled teams handle it. Untested teams freeze.
Q05Do you negotiate with attackers?
Do you negotiate with attackers?
We don't directly — but we work with negotiation specialists when payment is on the table. Many ransomware crews are now on US Treasury OFAC sanctions lists, which complicates payment legally. The decision to pay or not is the client's, informed by legal, insurance, and operational impact.
Q06What about the new SEC 8-K rule?
What about the new SEC 8-K rule?
US public companies must file Form 8-K Item 1.05 within four business days of determining a cybersecurity incident is material. The clock starts at materiality determination, not detection — but the determination itself can't be unreasonably delayed. We help draft the materiality framework and the 8-K-ready language before you need it.
Free 90-minute tabletop using a real 2026 ransomware scenario.
Your leadership team in a room with us. Realistic injects. No slides, no theory. You'll see exactly where your current readiness is — and isn't.