Ransomware Response: What the First 24 Hours Should Actually Look Like

The first hour: contain, do not investigate

The single most expensive mistake in a ransomware incident is trying to understand what happened before stopping it from spreading. Teams shipping ransomware response in 2026 face a market that has stopped rewarding novelty and started rewarding operational discipline. The vendors who win the next renewal cycle are the ones whose customers can answer three questions without opening a spreadsheet: what does this cost per unit of business value, who owns it when it breaks at 3 a.m., and what is the exit plan if the roadmap diverges from ours. Everything else — the benchmarks, the launch posts, the analyst quadrants — is noise around those three questions. The practitioners we spoke to for this piece kept coming back to the same theme: the interesting engineering work is no longer at the edges of what is possible, it is in the middle of what is sustainable.

In the first hour the priority is isolation. Network-segment the affected estate, disable the compromised identities, revoke the sessions, and take the affected virtualisation cluster off the management network. Everything else — attribution, root cause, negotiation — waits.

The teams that recover fastest have pre-approved isolation playbooks that can be executed by the on-call without a change ticket. If your incident response requires a CAB meeting to disable an account, you have already lost the incident.

Hours 2–6: preserve the evidence you will need later

The temptation in hour three is to start rebuilding. Do not. The forensic evidence that will support your insurance claim, your regulatory filings, and any downstream civil action lives on the disks and in the memory of the compromised hosts.

Snapshot every affected virtual machine at the hypervisor layer before touching it. Preserve the volume shadow copies. Export the last 30 days of authentication logs, EDR telemetry, and firewall flows to write-once storage. The cost of this step is a few hours; the cost of skipping it is a claim denial six months later.

Hours 6–12: understand the blast radius

Once containment holds and evidence is preserved, the response shifts to scoping. Which identities were used? Which systems did they authenticate to? Which data was accessed, and which was exfiltrated?

Exfiltration is the question that matters most for regulatory notification. Modern ransomware operators exfiltrate first and encrypt second, and the exfiltration is often visible in cloud storage egress metrics and DNS logs days before the encryption event.

This is also the point at which legal, communications, and executive leadership need to be looped in with a clear picture. The worst version of a ransomware incident is the one where leadership learns key facts from the media.

Hours 12–24: the recovery decision

By hour twelve the response team needs to make the recovery decision: restore from backups, rebuild from gold images, or — in the worst case — negotiate. Each path has a different timeline and a different set of pre-conditions.

Backup-based recovery only works if the backups themselves survived. Modern ransomware operators specifically target Veeam, Commvault, and cloud backup vaults. If your backup credentials share an identity plane with your production environment, assume the backups are compromised until proven otherwise.

Rebuilding from gold images is slower but produces a cleaner environment. The tradeoff is data loss between the last known-good backup and the incident.

What separates the fast recoveries from the slow ones

The organisations that recover in days rather than weeks share three characteristics: immutable backups on a separate identity plane, a documented and rehearsed isolation playbook, and a pre-agreed relationship with an incident-response firm.

None of these are technology decisions. They are operational and contractual decisions made months before the incident. The technology is table stakes.

The honest summary is that ransomware response in 2026 rewards teams who treat it as a product with users, a budget, and a roadmap — not as a project that finishes. The organisations getting ahead are not the ones with the biggest tooling investment; they are the ones with the shortest feedback loop between a production signal and a design change. That loop is a cultural artefact as much as a technical one, and it is built one boring review meeting at a time.