Ransomware is malicious software that encrypts your files and then demands payment for the key to unlock them. Most attacks now copy the data out first, so paying does not guarantee it stays private. How quickly you recover depends on whether your backups are isolated from the network and have been tested.

Ransomware Protection Services: Prevent & Recover

Q: Will our cyber insurance cover a ransomware claim?

Cyber insurance coverage depends on the terms of your policy and the circumstances of the incident. Insurers may ask for evidence that required controls, such as MFA and tested backups, were in place. Keeping security documentation current can help support the claims process. Our compliance consultation covers the evidence side.

THE REAL COST

What Ransomware Takes Before It Asks for Money

Ransomware is not one event. It is a quiet week inside your network followed by a very loud morning. By the time a ransom note appears, the attacker has usually already read your email, copied what they wanted and gone looking for your backups.

Get My Free Assessment Calculate Downtime Cost

A ransomware event usually means:
Every file encrypted, including ones you forgot existed
Backups deleted or encrypted before you notice
Your data published anyway if you refuse to pay
Phones, email and payroll down at the same time
A ransom note with a countdown and a wallet address
No guarantee the decryption key even works
Weeks of rebuilding after the systems come back
Forensics you pay for before insurance pays out
Breach notice letters to every affected customer
A second attack through the door nobody closed

HOW WE HOLD THE LINE

Prevent It, Catch It, Get You Back

Three jobs, and they are not interchangeable. Most providers sell you the first one and quietly hope you never need the third. Inside managed cybersecurity we plan all three in advance, because the recovery decisions are impossible to make well at three in the morning.

Build My Recovery Plan

Prevent
Close the doors ransomware actually uses: stolen logins, unpatched edge devices, email attachments.
Detect
Catch the staging behavior that comes before encryption, then isolate the machine, not the office.
Recover
Restore from copies an attacker cannot reach, in an order you agreed while everything was calm.

THE MECHANICS

The Three Controls That Decide the Outcome

Once encryption starts, three things decide whether this is a bad Tuesday or a bad quarter. None of the three is antivirus, and none of them can be bought in a hurry.

Immutable, Tested Backups

Copies even a stolen domain admin cannot delete, restored and checked on a schedule.

Isolation, Not Just Alerts

One infected machine leaves the network before encryption reaches the next one.

Identity and Least Privilege

MFA on everything, and no shared admin account lying around to be stolen.

Get My Free Assessment See Pricing

THE ATTACK CHAIN

Five Places to Stop It BEFORE ENCRYPTION

Ransomware is a chain of steps, not a single moment. Every step is a chance to end it, and every step you miss makes the next one cheaper for the attacker and more expensive for you. Here is the chain, and where we break it.

Where we break the chain
Entry: A phishing email, a reused password, or a remote-access port left open to the internet. Most events start at one of those three.
Foothold: The attacker installs tooling and works hard to look like normal traffic. Behavior monitoring catches this. Signature antivirus does not.
Escalation: Admin rights get harvested and reused across the network. MFA and least privilege make this the step where attackers usually get stuck.
Staging: Data is copied out and your backups are hunted first. This is the last quiet hour, and the one that decides what recovery options you have.
Encryption: Files lock and systems stop. From here only two things matter: how completely you isolate, and whether your backups survived step four.

Containment here is a logged, repeated action rather than a slide. Our security operations team has isolated 56 endpoints on client networks to stop something spreading, across 1,858 incidents raised between February 2018 and February 2026.

Source: ITS managed detection and response records, February 2018 to February 2026.

FAQ

What Businesses Ask Us ABOUT RANSOMWARE

Straight answers, including the awkward ones. If yours is not here, call us.

How do you actually prevent ransomware?

By closing the three doors it comes through, then watching them. Multi-factor authentication on every account, so a stolen password is not enough on its own. Patching on the servers and edge devices attackers scan for. Filtering and training on email, because most events still start with someone clicking. Then behavior monitoring on top of all three, because prevention is never perfect and the next best outcome is catching it early.

Should we pay the ransom?

Our answer is no, and it is not a moral position. Paying buys you no guarantee that the decryption key works or that all of it comes back. It does not stop your data being sold anyway. In regulated industries it can create a compliance problem of its own, and it marks you as a business that pays. We would rather spend that money making your backups good enough that the question never comes up. Here is our full reasoning.

How long does recovery actually take?

It depends almost entirely on your backups, not on us. With clean, immutable copies and a restore order you have tested, critical systems come back first and the rest follows in a sequence you agreed while everything was calm. If your backups were encrypted too, you are not restoring, you are rebuilding, which is a different job. We do not publish a recovery time on this page, because the state of your backups before the attack is what decides it. That is the whole argument for testing restores before you need one.

What makes a backup ransomware-proof?

Three properties, and it needs all three. It is immutable, so nothing holding your credentials can alter or delete it, including an attacker with domain admin. It is isolated, so it is not sitting on the same network as the thing being encrypted. And it is tested, meaning someone restored from it recently and timed how long that took. A backup nobody has ever restored from is a hope, not a plan.

Who do we have to report a ransomware attack to?

Usually more parties than people expect. The FBI, through its Internet Crime Complaint Center. Your cyber insurer, normally within a window your policy specifies. And any regulator covering the data involved, such as HIPAA for patient records or your state's breach notification law for customer records. Client contracts often add more. We keep your reporting obligations written down in advance, so hour one goes on containment rather than on reading contracts. Our guide to how to report it walks through the FBI process.

Will our cyber insurance cover a ransomware claim?

Only if you can evidence the controls you said you had when you signed the policy. How completely multi-factor authentication was deployed, and whether your backups were genuinely separated and tested, are the kind of things a carrier asks you to prove. If those answers are verbal, the claim gets slow. We keep the documentation current, so a claim becomes a form to fill in rather than an argument to win. Our compliance consultation covers the evidence side.

What if we are being attacked right now?

Disconnect the affected machines from the network first, and stop anyone else logging in. Where you can, leave those machines powered on: memory holds evidence that a shutdown destroys. Do not delete anything, and do not start paying attention to the countdown. Then get a person on the phone. ITS clients reach support on (888) 969-3636 and we work the containment steps with you from there.

[TO CONFIRM BEFORE PUBLISH: (a) Rob Schenk, Chief Strategy Officer, signs off the isolate-but-do-not-power-off guidance, because there are cases where halting encryption outranks preserving memory. (b) Whether ITS accepts emergency incident-response calls from non-clients, and on what terms. If it does not, this answer must say so plainly.]

CLIENT TESTIMONIALS

Clients Who Have Been Through It

We had an issue with a ransomware problem and our previous IT partner could not resolve it. It brought us to a standstill... so we reached out to ITS and they helped us with the issue.

Mark BreauningerThe Synthetic Grass Store

ITS identified an MFA hole in a large-scale EHR system that had never been caught before. Had it not been for them, we would've gone live and unknowingly increased our risk. Their insight not only protected us. It helped four other facilities that implemented the same system after us.

Doug McCoyCEO of Eastern Plumas Health Care (EPHC)

I think to not adopt some form of advanced security these days would be incredibly foolish. The biggest benefit ITS provides is the weight off my shoulders knowing that they're involved and we've prepared ourselves as best as we could for any cyberthreats. That's the most important to us.

JP HalversonMcQuarrie Associates

ITS helped us implement a layered security model addressing both our immediate needs and long-term goals. Our executive team sleeps better at night, and our remote staff can work security and efficiently. With ITS as our partner, we're confident that we can fulfill our mission securely and efficiently.

Sarahvon BuenavistaUnited Way Bay Area

What you don't want is someone from another country shutting you down and taking all of your money, because this is our livelihood. You are keeping us secure so we can sleep at night and help us make sure all of our 600+ employees have a job tomorrow.

Tully W.The Niello Company

Everyone's worried about phishing or accidentally opening an email, and it's important your company provides training for our employees and, ongoing support.

Carma OaksmithFinance Director, City of DuPont

RECOVERY

What Recovery ACTUALLY LOOKS LIKE

Nobody walks you through this part before you need it, so here it is. Three phases, in order, with the decisions that get made in each. These are the phases of a plan, not a service level.