When a company calls us because no server is starting, the conversation is always similar. And the order in which the first decisions are made explains much of the difference between a three-week file and a four-month one.
Before the encryption, they had already been inside for weeks
Encryption is the end, not the beginning. Access usually occurs days or weeks before through a valid credential purchased or reused, and that time is spent moving through the network, elevating privileges, and locating backups. That's why backups connected to the domain are lost with the rest: it's not bad luck, it's the attacker's declared objective before launching the encryption.
The first call decides the rest of the file
Cyber policies work with a response panel: forensic expert, specialised lawyer, and negotiator, activatable by a phone available at any time. Hiring your own forensic expert independently before notifying often clashes with the requirement for prior authorisation from the insurer and opens a discussion on whether the expense is reimbursable. The correct sequence is notify first and hire later, even if it seems counterintuitive with systems down.
What the real bill consists of
In order of usual amount: loss of profits for the days not operating, hours of environment reconstruction, forensic expert, legal assistance, and notifications to affected parties and the control authority. The ransom, when it is paid, is rarely the dominant item. It is advisable to check that the sublimit of interruption and the waiting period, often between eight and twelve hours, fit with what the company can withstand being stopped without commercial damage.
Reconstruction costs more than budgeted
Restoring is not just returning the data to its place: it is setting up a clean environment, without the door through which they entered, with a rebuilt active directory and rotated credentials. In medium-sized organisations, that means weeks of work. Here the guarantee that makes the difference is the system improvement, which covers the part of the reconstruction that leaves the infrastructure better than it was, and not all policies include it.
The three things that should be resolved today
A backup disconnected from the domain and tested with a real restoration in the last six months. A notification phone to the insurer accessible outside corporate email, because during the incident email does not work. And a printed list of critical contacts: management, systems manager, legal advisor, and broker. It sounds elementary until the night it's needed.
