Ransomware Recovery Starts Before the Attack
EXECUTIVE INSIGHT
Ransomware can stop orders, delay deliveries, and interrupt billing. Stolen information can damage trust even after operations resume. For leadership, this is a business continuity issue: how will essential work continue or restart safely? This Insight explains the changing threat and the preparation, recovery, and provider responsibilities needed to protect customer commitments.
BriarArc recommends giving recovery at least as much leadership attention as prevention.
The Criminal Business Model Is Changing
Criminals seek payment by disrupting business operations or threatening to disclose stolen information. The FBI describes a ransomware ecosystem that includes developers, affiliates, and service providers. BriarArc views disruption and disclosure threats as different ways of increasing pressure on a business to pay. [1, 2]
The model has expanded beyond locking files to include stealing information and threatening to publish it. Combining encryption with threats to expose stolen information is often called double extortion. Some criminals demand payment over stolen information without locking files. Ransomware as a service allows developers to supply tools to others who conduct attacks. These methods coexist. [1, 11]
AI can help criminals produce convincing messages and impersonate voices, as the FBI warns. Anthropic has reported cases involving AI-assisted ransomware development and the analysis of stolen information for extortion. These observations show how AI may reduce effort and help criminals tailor their demands. They do not establish how common AI use is or that attacks are fully autonomous. [9, 10]
BriarArc expects criminals to keep testing automation and tailored demands. We recommend verifying unusual requests through known contact routes. A familiar voice or polished email should not be enough to authorize access or payment.
Prepare to Keep Work Moving and Restore It Safely
Identify which business commitments matter most, how long they can be interrupted, and what work can continue through approved temporary arrangements. Establish a recovery order based on the activities your customers and employees depend on.
Designate an incident lead to coordinate your business’s response. Identify a qualified incident responder, either an internal specialist or an external incident response provider, to support the technical response. Define each role and who can authorize urgent action in your response plan. [13]
Protect recovery copies of essential information and test that they can be restored, consistent with Microsoft’s guidance. [8] BriarArc recommends rehearsing the recovery of an essential business activity, including the systems, information, and employee access needed to complete it.
Example: Preparing Before an Attack
Imagine a distributor that cannot use its order system. Before an incident, the distributor’s leadership approves a limited process for taking urgent orders by phone, sets spending limits, and identifies how to verify stock.
Employees rehearse the process and record orders securely so they can enter them into the system later without duplication. This hypothetical workaround depends on the business’s needs and available resources.
Example: Recovering After an Attack
Your designated incident responder helps your IT team or provider contain the attack and establish a trusted environment for recovery. Together, they follow an agreed recovery order that reflects the systems your business uses and each team’s responsibilities.
Microsoft’s disaster recovery guidance illustrates why supporting services matter: some applications depend on identity and DNS services that may need to be restored first. [5]
At this hypothetical distributor, restoring order records is one step. Employees also need safe access. The employees responsible for orders, supported by the distributor’s IT team or provider, then test taking an order, checking stock, and issuing an invoice.
A designated business leader approves resuming service after reviewing the recovery checks. Employees reconcile the orders recorded during the outage.
Recovery must also address stolen information. Restoring systems does not remove information already stolen by criminals. The FBI does not support ransom payments and warns that payment does not guarantee the return of data. [1, 3]
Confirm What Providers Will Actually Do
Cloud services, managed service providers (MSPs), and managed security service providers (MSSPs) can strengthen protection and recovery. Their responsibilities depend on the service and agreement. Your business retains responsibilities for the information, accounts, access, and settings it controls. Outsourcing IT services does not remove the need to manage business risk. [6, 7]
The FBI and CISA have warned that holidays and weekends can give attackers an advantage when network defenders and IT support teams are operating at reduced capacity. [12] BriarArc recommends planning for incidents during those periods and outside normal business hours.
Confirm which internal staff or contracted providers monitor for threats, who can authorize urgent action, which providers support recovery, and what additional costs apply during those periods.
Rehearse with the providers named in your response plan. Agree on alternatives if a provider is unavailable, and identify any responsibilities that fall outside your existing service agreements.
Arrange Response Support and Communications
Before an incident, identify experienced breach-response counsel and confirm the availability of your designated incident responder. If you have cyber insurance, identify the appropriate contacts at your insurer.
Confirm each party’s role and availability, any applicable insurance requirements, and the circumstances that trigger involvement. Your breach-response counsel helps determine applicable notification requirements. Report suspected cybercrime to law enforcement through verified reporting channels. [3, 4]
Example: Coordinating When Company Email Is Unavailable
During a ransomware incident, company email becomes unavailable or cannot be trusted. Your incident lead uses an independently accessible contact list to reach your breach-response counsel, incident responder, IT and security providers, law enforcement, and insurer if applicable. The list includes verified telephone numbers, after-hours contacts, and backup contacts.
The participants use alternative communication channels agreed upon before the incident. They confirm identities through known contact details, keep legal discussions confidential, and share technical evidence and recovery instructions securely with those who need them for their assigned tasks. A designated person coordinates approved operational updates for employees, customers, and partners.
These arrangements are tested without the company’s usual email or sign-in system. A different app may depend on the same affected account or network, so the plan includes a second fallback. This hypothetical example applies CISA and NIST guidance on independent communications and reflects BriarArc’s recommendations. [1, 13]
Six Questions Leadership Should Ask
Which essential activities must return first, and what systems and information do they depend on?
Have we demonstrated recovery, including how long it takes and what work could be lost?
Who leads our business response, who handles the technical incident response, and who can approve urgent action?
What recovery support have our providers agreed to deliver, including after hours, and what additional costs could apply?
Have we rehearsed how to respond to both interrupted operations and threats to expose stolen information?
When do we engage our breach-response counsel and incident responder, notify our insurer if applicable, contact law enforcement, and notify affected people?
What to Do Next
Ask your operations leader and relevant IT, security, or incident response providers to demonstrate how one essential business activity would resume after a ransomware attack.
Use the results to identify recovery gaps, assign responsibility for improvements, and prioritize investments in protected backups, reliable access, tested recovery, and response support.
Executive Cyber Clarity™
BriarArc Cyber helps leaders of small and mid-sized businesses understand cybersecurity in clear business terms. We explain what matters, why it matters, what to do next, and where cybersecurity investments can best support the business.
Coming Next
AI in Cybersecurity Today and Tomorrow
Our next Executive Insight explores how AI is used in cybersecurity and how leaders can manage unintended harm through verification and appropriate human approval.
Research Sources
Original research reviewed on 5 October 2026. References updated on 20 October 2026.
Descriptions of criminal tactics and AI misuse are drawn from the cited sources. Business interpretations, recommendations, and hypothetical examples reflect BriarArc’s analysis. Vendor-reported cases do not establish how common AI use is. Future developments remain uncertain.
[1] CISA and partners — #StopRansomware Guide, October 2023 (copy hosted by the U.S. Treasury)
[2] FBI — Cybercrime and the ransomware ecosystem
[3] FBI — Ransomware reporting and payment guidance
[4] FTC — Data Breach Response: A Guide for Business
[5] Microsoft — Set up disaster recovery for Active Directory and DNS
[6] Microsoft — Shared responsibility in the cloud
[7] CISA — Risk Considerations for Managed Service Provider Customers
[8] Microsoft — Backup and restore plan to protect against ransomware
[9] FBI — Warning on AI-assisted phishing and voice/video impersonation
[10] Anthropic — Detecting and countering misuse of AI: August 2025
[11] CISA, FBI, and international partners — Understanding Ransomware Threat Actors: LockBit
[12] FBI and CISA — Ransomware Awareness for Holidays and Weekends