.png){kind=logo}
Who Makes the Call When Ransomware Hits?
A food and beverage manufacturer’s tabletop success story.
Project Information
THE CHALLENGE
The organization’s IR plan had never been tested at the executive level. The gaps that matter most in a real ransomware event — who has authority to approve a ransom negotiation, how evidence gets preserved, when and what to tell customers — aren’t things a document review can surface. They only show up when leadership has to make those calls out loud, under time pressure.
THE CLIENT
A regional food and beverage manufacturer running multiple production lines and a distribution network. Production doesn’t pause cleanly when systems go down, and even a short outage can mean a missed shipping window with a retail or distribution partner. The company’s executive leadership, legal counsel, and communications team had a written incident response (IR) plan on file but no way to know whether the plan’s assumptions about who decides what, when, and how fast would hold up once an attack was underway.
THE SECURANCE SOLUTION
Designed and facilitated a focused, executive-level tabletop exercise to test decision-making.
Built a realistic scenario: a compromised domain admin account that escalated to a company-wide ransomware incident within the exercise’s first hour, forcing a network disconnect and an out-of-band call with executive leadership, legal, and communications.
Layered in escalating complications over the course of the exercise: a ransom demand, an assumption that all production data had been exfiltrated, local media already alerted, and rumors spreading among employees on social media before any official word had gone out.
Put the hardest questions to the people who’d have to answer them in a real event: what ransom ceiling executive leadership would authorize; what evidence preservation and chain-of-custody procedures legal would follow; and what communications would tell employees and customers, and when.
Captured every point where the group was unsure or had to guess as a formal finding, and assigned each one to IT, legal, or communications to resolve before the next exercise.
CLIENT SUCCESS
The exercise surfaced three questions the plan had left to assumption: who can set a ceiling for ransom negotiations, how evidence gets preserved, and when customer communications go out once legal signs off. Each answer is now written down with a named owner. The executive team has also rehearsed the calls a ransomware attack would demand, and every remaining gap is documented and assigned, to be closed before the next exercise.