A ransomware Friday, as a tabletop exercise
The scenario we run with a 400 person manufacturer’s leadership team every year, and the three decisions it always comes down to.
Dana Okafor, day watch lead
10 min
It is 22:40 on a Friday. The second shift reports that the scheduling system shows a ransom note. Who is called first, who can approve shutting down the plant network, and who talks to the customer whose parts ship on Monday?
The three decisions
Isolate the plant network now, or keep the line running and watch.
Call the insurer’s hotline before or after the forensic team.
Tell key customers on Saturday, or wait for facts on Monday.
What changes afterwards
Every exercise ends with a one page list of names, numbers and pre-agreed decisions. The companies that have one recover days faster than the ones that improvise.
Thirty minutes to find out who is watching your network tonight.
Bring your last insurance questionnaire or audit finding. We tell you in plain words where you are exposed after hours and what closing it would cost, then send a written quote within two business days.