Red Team and Adversary Simulation
Ransomware Simulation
We test how a ransomware attack would spread in your network, without encrypting any data. We show where the spread stops and whether your backups are protected from the attacker.
What it is
A ransomware simulation reproduces in a controlled way the preparation steps seen in real attacks before encryption. These include gaining broad privileges, targeting backups and spreading to multiple systems. The encryption stage is simulated only on test files created for the exercise. This shows how detection, isolation decisions and recovery from backup would work in a real incident.
Scope
- Spread paths from an endpoint to servers and management systems
- Whether backup servers and backups are inaccessible to the attacker
- Encryption behavior simulated harmlessly on test files
- At which step EDR, SOC and network controls stop the spread
- Rehearsal of isolation, communication and notification decisions on the same scenario
The need
When organizations need it
- When ransomware has halted an organization in your sector and management asks about the same risk.
- When your incident response plan must be tested annually and you want a realistic scenario instead of a discussion.
- When you want to see if a new backup or EDR solution actually protects you during an attack.
Method
How we work
-
Scenario
We build a scenario based on the known steps of ransomware groups targeting your sector.
-
Technical simulation
We test the spread and backup access steps on approved systems, without encrypting data.
-
Decision rehearsal
With management and the technical team, we rehearse isolation, communication and notification decisions on the same scenario.
-
Recovery check
We measure the restore of a selected system from backup and consolidate all results in a single timeline.
Outcome
What you have at the end
You know where the spread stopped and whether your backups would remain usable after an attack. You receive prioritized changes that limit the spread and accelerate recovery.
Frequently asked questions
Is real ransomware deployed on our systems?
No. No real malware is used and no data is encrypted. The encryption step is simulated only on test files created for the exercise.
Is it safe to run in production?
The scenario is run on systems and during time windows agreed with you. Every step that could affect service is pre-approved and stop conditions are documented.
How is this different from a tabletop exercise?
A tabletop exercise rehearses decisions through discussion. This simulation tests the same decisions against technical steps that actually occur in your network.
Red Team and Adversary Simulation
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting