Ransomware Risk Assessment

Ransomware incidents rarely rely on a single flaw. They grow from a combination of a compromised account, weak segmentation, excessive privileges and unprotected backups, a chain that a general risk assessment does not always reveal.

This assessment looks at your organization through one question: if an attacker got in today, could they stop your business, and how fast could you recover?

Most attacks follow a similar path. Our assessment looks for controls that stop the attacker at each link of this chain:

1. Initial access: a phishing email, a stolen password or a vulnerable internet-facing service
2. Privilege escalation and lateral movement: compromising privileged accounts and spreading across the network
3. Targeting backups: deleting or encrypting backups
4. Exfiltration and encryption: stealing data and rendering systems unusable

• Backup and recovery: the 3-2-1 rule (three copies, two media types, one copy offsite), immutable or offline backups, access to backup infrastructure and restore testing
• Network segmentation: separation of critical server, backup and management networks; lateral movement paths
• Privileged access: domain admin and service accounts, MFA (multi-factor authentication) and access to management interfaces
• Email and initial access: phishing protections, remote access (VPN, RDP) and internet-facing services
• Endpoint protection: EDR (endpoint detection and response) coverage, configuration and alert handling
• Incident readiness: response plan, communication and decision processes, recovery priorities for critical systems

1. We identify critical systems and acceptable downtime with you.
2. We review configurations, backup architecture and processes through interviews and technical inspection.
3. We analyze the paths an attacker could take through Active Directory and the network.
4. We score findings by likelihood and business impact and report them.

• Summary table of readiness by area
• Attack path analysis and critical findings
• Prioritized roadmap split into short, medium and long term
• A plain-language summary presentation for management

Manufacturing, healthcare, logistics and financial organizations that cannot afford downtime, and companies that want a clear baseline before renewing backup or security infrastructure.