Anatomy of a ransomware recovery: the 40 minutes that matter

The following is a composite, illustrative walkthrough — not a specific client. It shows how the pieces fit when a business is actually prepared, and why the difference between a bad day and a closed business is measured in minutes.

2:11 AM — the kickoff

Ransomware almost never detonates at noon. In this scenario it starts on a Sunday, from a foothold established days earlier through a phished login. The attacker begins encrypting a file server.

2:14 AM — detection

Endpoint detection flags the mass-file-modification behavior — not a known signature, but the pattern of encryption. Because there's 24/7 monitoring, an analyst is looking at it within minutes, not Monday morning.

2:23 AM — containment

The affected host is isolated from the network automatically, cutting the encryption off before it spreads to the rest of the environment. This is the moment that decides everything: contained, it's one server; uncontained, it's the whole company.

The recovery isn't the heroics. It's the boring preparation the attacker couldn't touch.

The next morning — recovery

The one encrypted server is restored from an immutable, offsite backup that the ransomware could not reach or delete — a backup that had been tested, so the restore is routine rather than a prayer. Business opens on time. No ransom paid, because there was nothing to ransom.

What made the difference

None of it was luck. It was MFA that limited the blast radius, detection that caught behavior, monitoring that had a human awake, and backups that were immutable and tested. Every one of those is a control your carrier now asks about — and the insurability self-check shows which you have.