It’s 11:58 PM on a Tuesday. A finance manager at a mid-sized manufacturing firm gets a Slack message from IT: file shares are acting strange. Reports won’t open. A shared drive that held two decades of engineering drawings now shows every filename ending in a string of random characters. Then the wallpaper on a shop-floor workstation changes to a red screen with a ransom note.
This is how most ransomware incidents actually begin, not with sirens, but with someone noticing that something small is wrong, thirty seconds before they realize it’s very large. What happens in the next fifteen minutes determines whether this becomes a contained, recoverable incident or a multi-week shutdown.
This is a walk-through of that window, composited from how CyberClan’s incident response engagements actually unfold, built around oour 15-minute SLA for getting a live responder on the phone. It’s a look at what a real ransomware incident response looks like when the clock is the enemy.
T-minus: The Moment of Detection
11:58 PM. The IT lead can’t get into the file server. A second employee reports the same thing on a different share. Within two minutes, someone finds the ransom note, a .txt file dropped in a dozen folders, demanding contact within 72 hours “or the price doubles.”
This is the moment most companies lose time they can’t get back: arguing about who to call, digging for a contract, trying to fix it internally first. The firm in this scenario doesn’t do that. They call the number on their incident response retainer.
12:00 AM — T+0. The call goes to CyberClan’s 24/7/365 Emergency Response Team. This is the start of the clock.
The First 15 Minutes
T+2 min. The call is answered, not by a call-center queue, but by someone who can triage a live incident. This distinction matters more than it sounds: a ransomware incident response that starts with “let me transfer you” has already lost minutes an attacker is actively using to spread laterally.
T+6 min. The intake questions start, fast and specific: What triggered the alert? Is the activity still ongoing? Which systems and data are affected? Is there a recent, verified backup? Has cyber insurance been notified yet? Every answer shapes the next decision, this isn’t a script, it’s triage.
T+11 min. Early signals point to encryption still spreading, a second and third machine have gone dark on the shop floor in the last few minutes. That single fact changes everything downstream: this is now a live, moving incident, not a post-mortem.
T+15 min, the SLA. A member of CyberClan’s global Incident Response team is fully engaged and directing the client’s next move in real time. This is the commitment the we built our model around: fifteen minutes from first contact to an experienced responder actively working the case, not a callback or a ticket number.
That’s the part of the timeline that’s easy to market and hard to deliver at 3 AM on a holiday weekend. It’s also the part that determines everything else. A ransomware response timeline that starts fast tends to stay fast; one that starts slow rarely catches up, because ransomware operators don’t pause while a vendor gets back to you.
The Next Hour: Containment Decisions
Speed in the first fifteen minutes buys the room to make good decisions in the next forty-five.
T+22 min. The responder makes the first containment call: isolate the two affected VLANs and pull the shop-floor segment off the network entirely, rather than shutting down the whole environment. Overreacting, killing everything can destroy volatile evidence and cause more downtime than the attack itself. Underreacting lets the encryption keep spreading. Getting that balance right, fast, is the actual skill being paid for.
T+31 min. Endpoint monitoring goes live across the isolated segments and the broader network, so the team can watch for movement without tipping their hand to whoever, or whatever is still inside.
T+41 min. The team starts tracing the attack backward: which account logged in first, from where, and when. This is the hunt for “patient zero”, the initial point of compromise, usually a phished credential, an exposed RDP port, or an unpatched edge device.
T+58 min. Active encryption stops. The isolated segments hold. This is containment, not resolution, not recovery, but the point where the incident stops getting worse in real time.
T+60 min, one hour. As promised at intake, the client receives a Statement of Work: what’s been done, what’s confirmed, and exactly what happens next, with named responsibilities on both sides. No ambiguity about who owns what while the business is still bleeding.
What Comes After Containment
Containment is the headline moment, but it’s the middle of the story, not the end. Over the next few days, the team works through:
Root cause analysis, closing out exactly how the attacker got in and whether they still have a foothold anywhere else. Evidence preservation to a recognized forensic standard (CyberClan follows the EDRM framework), because whatever gets found here may need to hold up for an insurance claim, a regulator, or a courtroom. Active threat hunting across the full environment, on the assumption that a ransomware crew rarely announces itself the moment it lands, the note on the screen is usually the last step of a much longer, quieter intrusion. And, where negotiation and recovery are on the table, specialists who’ve done this before, rather than a business owner exchanging messages with a ransomware operator for the first time in their life.
That’s also where the team composition stops being a marketing line and starts mattering practically: people pulled from law enforcement, military, DevOps, and hostage-style negotiation backgrounds are doing genuinely different jobs inside the same incident, often in the same hour.
Why the First 15 Minutes Decide the Next 15 Days
The uncomfortable truth about ransomware is that the outcome is disproportionately decided before most companies even feel like the “real” response has started. Every minute an attacker has uninterrupted access is a minute they can spend expanding their foothold, exfiltrating data for a double-extortion threat, or finding and disabling backups.
A fast, competent first quarter-hour doesn’t guarantee an easy recovery. But a slow one, spent searching for a contact, waiting on hold, or trying to handle a live intrusion without anyone who’s done it before, almost always guarantees a harder one.
That’s the entire case for building a ransomware incident response plan before the ransom note appears, not after: knowing exactly who you’re calling, having that number saved somewhere other than the encrypted file server, and knowing that when you call, someone experienced picks up in minutes, not hours.
If you’re facing an active incident right now
CyberClan’s Emergency Response Team is available 24/7/365
US/CA: 1-800-762-3290
UK: 0800-368-8731
AU: 61-1800-413-128
