Ransomware is a forced decision under pressure. Are you ready to respond?
The UK’s National Cyber Security Centre (NCSC) has been pretty clear: ransomware is still one of the most significant cyber threats that organisations face today.
That warning isn’t new news. Yet ransomware continues to succeed.
It’s certainly not because organisations are unaware of the risk. And it’s not because there are no controls, playbooks or training materials in place.
It’s because ransomware is a high-pressure operational event, played out in real time. Where decisions must be made when all the facts are still unclear, when people are under stress and seeing consequences that escalate rapidly. You might even imagine you’re a cast member in the latest high-octane action packed blockbuster movie.
And many organisations discover they are far less prepared than they believed.
Having a plan is not the same as being ready
Think about how people learn to avoid a punch.
Watch enough videos online and it looks straightforward: you see the movement, anticipate the strike, and react accordingly.
But real life is different.
The punch usually lands before you’ve fully processed what is happening.
Ransomware works in much the same way.
In theory, organisations often appear prepared. They can show you their documented incident response plans, walk you through their escalation procedures and tell you all about everyone’s roles and responsibilities.
On paper, it all looks fabulous. But as soon as ransomware hits, theory gives way to reality.
A laptop screen changes. Files become inaccessible. A ransom demand appears. A timer starts counting down.
Game on.
The real challenge is human, not technical
Many ransomware attacks still begin when a phishing email is opened by an unsuspecting employee. Credentials are exposed. An unpatched vulnerability is exploited. A supplier is compromised.
Technical controls matter enormously, but prevention alone is not enough.
No organisation can realistically claim a 100% guarantee against ransomware.
The real differentiator is what happens next.
When systems are unavailable and operations are disrupted, people are forced into decisions under intense pressure.
From a psychological perspective, teams often move through a familiar cycle:
Attackers understand this dynamic well and use it to their advantage.
Ransomware is specifically designed to exploit the uncertainty, urgency and emotional stress. The countdown clock is a pressure mechanism.
The objective is not only to encrypt systems, but to force people to rush their decisions.
The first hour matters most
The most important phase of a ransomware incident is often the first 60 minutes. Questions arrive immediately: what’s been affected, how far the compromise has spread, what should be isolated, who has the authority to make containment decisions, which systems are truly business-critical, and which stakeholders need to be informed straight away.
The first 10 minutes can determine containment. The first 30 minutes can determine the scale of operational disruption. Within an hour, the trajectory of the incident is often set – whether it remains contained or escalates into a full crisis.
This is why ransomware preparedness shouldn’t just live within a process or a policy document. It has to be operational.
Preparedness is built through repetition
The organisations best positioned to handle ransomware rehearse their plans.
Effective preparedness includes:
regular ransomware simulations and tabletop exercises
live incident drills across technical and business teams
repeated role-based training under realistic conditions
supplier and third-party cyber posture validation
tested communication and escalation pathways
clearly defined authority structures for crisis decision-making
This is all about building organisational muscle memory.
Ransomware readiness is about operational resilience
Most organisations understand ransomware. The real question is whether they can function when prevention fails. Can they respond under pressure, maintain critical services and make decisions with little or no information.
Ransomware is an organisational resilience challenge. Those who respond best aren’t the ones with a library of documentation, but those who have spent the time preparing, testing and repeating those again and again.
Because when the moment comes, it won’t feel like a training exercise or a neatly documented process. It will feel more like that action blockbuster scene — fast, chaotic and unforgiving – where there’s no time to rewind or rethink.
And just like the punch you never quite see coming, success isn’t about knowing what should happen next.
It’s about whether your people are ready to react in time.
